Add Google Sign-In

Set up native Google Sign-In in a React Native app: client IDs, iOS URL schemes, Android SHA fingerprints, and server-side token verification.

This guide covers adding Google Sign-In to a React Native app, on both Expo (via expo-auth-session) and bare React Native, and verifying the resulting token on a backend.

Quick Answer

Create OAuth client IDs in Google Cloud Console for iOS, Android, and Web; add the iOS URL scheme and Android SHA fingerprints; use expo-auth-session (or @react-native-google-signin/google-signin for bare RN) to get an ID token in the app; then verify that token on your server before trusting it.

1. Create OAuth Client IDs

In Google Cloud Console → APIs & Services → Credentials, create three OAuth client IDs under the same project:

  • a Web client ID, used as the clientId your app requests tokens for;
  • an iOS client ID, tied to your app's bundle identifier;
  • an Android client ID, tied to your app's package name and SHA-1 signing fingerprint.

2. Get the Android Signing Fingerprint

Google needs your app's SHA-1 (and SHA-256) fingerprint to verify requests. For a local debug build:

keytool -list -v -alias androiddebugkey -keystore ~/.android/debug.keystore

Register both your debug fingerprint and your release signing key's fingerprint in the Android OAuth client. Missing either one is the most common cause of "it works on my machine" Google Sign-In bugs.

3. Configure iOS

Add the iOS client ID's reversed form (e.g. com.googleusercontent.apps.XXXX) as a URL scheme, either in app.json under ios.config.googleSignIn.reservedClientId (Expo) or in Xcode's URL Types (bare RN).

4. Request Sign-In from the App

With expo-auth-session, use the Google auth request hook with your Web client ID, request the openid profile email scopes, and read the returned ID token on success.

5. Verify the Token on Your Backend

Never trust the client-reported email/name directly. Send the ID token to your server and verify it against Google's public keys (most backend Google auth libraries do this in one call), confirming the aud claim matches your client ID before creating or logging in a user.

Common Issues

DEVELOPER_ERROR (Android) almost always a missing or mismatched SHA-1 fingerprint, or the package name in Google Cloud not matching applicationId.

Works on iOS, fails on Android check that the Android OAuth client has both debug and release fingerprints registered.

Token verification fails on the server confirm you're checking the token's aud against the correct client ID; using the wrong one of the three IDs is a common mistake.

Sign-in succeeds but silently does nothing the app usually isn't awaiting the auth result correctly; confirm the promise/hook result is checked for a success type before proceeding.

Verification Checklist

  • Web, iOS, and Android OAuth client IDs all exist in the same Google Cloud project;
  • both debug and release SHA fingerprints are registered for Android;
  • the iOS URL scheme is configured;
  • a sign-in returns an ID token in the app;
  • the backend verifies the token's signature and audience before creating a session.

Next Steps