title: Google OAuth on android/react native won't even initialize, unspecified problem with redirect_uri?
body: <p>Recently I deployed an app to the internal testing track in the play store. I had to fix the app package name to do so - my mistake naming it poorly in development - and it may be responsible for breaking something, mysteriously, in the Google OAuth system.</p>
  <p>The error that Google displays is useless... It tells me I violated a policy! But not which one. It just says something about the <code>redirect_uri</code>.</p>
  <p>I've been staring at the message <code>&quot;You can't sign in to this app because it doesn't comply with Google's OAuth 2.0 policy for keeping apps secure.&quot;</code> for days now, tearing my hair out. Apparently almost nobody else has seen this message, and it's not documented.</p>
  <p><a href="https://i.stack.imgur.com/AuIDq.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/AuIDq.png" alt="screenshot" /></a></p>
  <p>I had suspected I was using the wrong SHA1 certificate, but though it may have been incorrect, fixing it has not helped it.</p>
  <p>Using the old (pre play store) package name in the cloud console works in dev, but not in production. Yes, I have a separate client id for the dev (signed with the default SHA1 for local dev) and a client id for the play store signed app... I'm <em>pretty</em> sure I've got it right now, though again, no details, I don't know. There's a reason I'm so obsessive about error codes and exceptions when I build software myself!</p>
  <p>The only thing I've been able to do to change anything is by manually messing with the <code>redirect_uri</code> that expo-auth-session sends to Google, which sometimes causes a <code>redirect_uri_mismatch</code>... This indicates to me that the <code>redirect_uri</code> I'm using <em><strong>is</strong></em> a match? Meanwhile, <code>redirect_uri_mismatch</code> <em>is a documented error code</em>, but <em>not</em> <code>redirect_uri</code>.</p>
  <p>What makes this more annoying is that apparently Google cloud OAuth config can take a long time to update, apparently up to a couple hours, but I have no idea when it's updated... So I can't tell if I'm testing against the propagated config changes? Huh??</p>
  <p>I happen to believe that <em>the lack of diagnostic info itself</em> is a bug (how can you debug an opaque failure? An undocumented error?), <a href="https://issuetracker.google.com/issues/224796229" rel="nofollow noreferrer">But it seems like Google does not agree?</a></p>
  <p>If it's helpful, I've been using Google OAuth for a year now for the web app part of this project... Never had this problem. I'm ready for launch. This is the only thing blocking. What am I to do?</p>
  <p>There is a similar discussion about the Nest app, but that is attributable to the phase out of unsafe schemes: <a href="https://community.home-assistant.io/t/nest-authorization-error-error-400-invalid-request/399388" rel="nofollow noreferrer">https://community.home-assistant.io/t/nest-authorization-error-error-400-invalid-request/399388</a></p>