Google Api and android Oauth INVALID_AUDIENCE error

Question

I am getting a GoogleAuthException: Unknown error, while doing a GoogleAuthUtil.getToken.

Just before the exception I see

Answer 1

In the interest of documenting my issue,

I had the same INVALID_AUDIENCE error come back from a Google sign-in through an AWS Mobile Hub generated sample app. A few things to check,

Like Tim Bray notes aboves, make your client id a valid web client id (not Android). But also have an android client id that has both the proper SHA-1 Fingerprint (found in debug.keystore which Android Studio uses to sign debug builds when you click Run) and package name.

NOTE: The package name listed in the AndroidManifest.xml is not always the actual package name. To find the definitive package name, go to the build.gradle file and see the applicationId field. Be sure to input the right package name in the Developers Console when you configure the Android Client Id.

Answer 2

Also you have to set up oAuth authorization screen in your Google API Console.

That was why I got this error

Answer 3

Happened to one on my team although it worked ok on my device. It turned out to be because of a different debug.keystore on our eclipse installations.

To solve it we've copied the company's debug.keystore file to ~/.android/ (this is the dir on a mac, it's different on linux and windows)

Answer 4

Looks like that should work; here's the scope-init code from my app which does work.

private static final String SCOPE = "audience:server:client_id:" + SERVER_CLIENT_ID;

So it smells to me like there's a problem with the client id. Remember that

1. You have to have a project with two client ids
2. One is the one for your android app, with the SHA & package & so on
3. The other is for the server side that you're going to send the token off to

It's the client ID from #3 that goes after ...:client_id:

Answer 5

Solve this by deleting your debug.keystore found in your .android folder, then run the new project again to generate a new debug.keystore file. Then finally generate a new SHA-1 signing-certificate for Google API.