Match the selected application ID
Follow the Firebase Android setup guide. The client entry must match the relevant package identity, including flavor or build-type suffixes.
A package mismatch can fail processing or select the wrong environment in a poorly organized multi-app setup. Read the actual variant's application ID rather than guessing from its folder name.
Organize variant configuration explicitly
The Android build and variant guides explain source-set selection. Use supported variant-specific configuration placement where needed instead of a pre-build script that silently copies whichever file was edited last.
| Environment | Desired property |
|---|---|
| Development | Separate project/data where practical |
| Staging | Reproducible test configuration |
| Production | Reviewed package and backend identity |
| CI | Deterministic selection without developer-local state |
Understand what the file does not contain
It is not a complete export of Security Rules, OAuth configuration, App Check enforcement or billing settings. A correct file cannot prove that those backend controls are safe.
Do not add service-account private keys or other server credentials to the file. Client configuration and privileged server credentials have different trust boundaries.
Verify generated behavior
Build the intended variant, inspect its identity and perform a controlled operation against the expected Firebase app. For sign-in, also verify the certificate of the distributed build.
A successful Gradle sync is weaker evidence than a test event or request reaching the correct project.
Plan migrations as release changes
Changing Firebase projects can affect authentication users, data paths, notifications and historical reporting. Treat it as an application/backend migration with compatibility planning, not merely a file replacement.
APKLint's scanner can help inspect packaged Firebase configuration. It cannot make installed apps switch projects or validate private console state; use it to confirm what the artifact actually contains.
Follow one flavor's configuration selection
Suppose the same repository produces a staging app with an application-ID suffix and a production app without it. Download configuration for the intended registrations and use the Google services plugin's supported build-type or flavor placement. Keep a small mapping from variant to application ID, Firebase project ID and configuration location. This makes an accidental staging-to-production switch visible in review.
Build each relevant variant and inspect the generated resources or packaged configuration alongside the final package identity. The Firebase multi-project guidance explains environment-specific setup. A file's directory name is only an input convention; the verification needs to establish which values the actual build selected.
Review configuration changes by field meaning
A changed project number, mobile app ID, package entry or client key can mean different things. Identify the reason for each changed field instead of approving the file as an opaque download. For example, adding a registration for a new staging package is different from moving the production application into another Firebase project. The latter can affect existing users, data, messaging and reporting beyond the build itself.
Do not merge two downloaded configuration files by concatenating JSON fragments or copying an apparently similar client entry. Obtain the supported file for the intended registrations and retain its provenance. A syntactically valid hand-edited file can associate values that do not represent a working Firebase app.
After a planned configuration change, run a controlled operation using the exact variant and distribution path. Confirm the operation reaches the intended project, then verify that a disallowed operation remains denied. For a production migration, separately plan data and account continuity; the JSON replacement does not migrate backend state. Keep privileged service-account material in authorized server or CI secret storage, never in this client file. If a scanner reports the packaged client key, classify its role before responding: public Firebase identifiers, restricted API usage and backend authorization need different checks. The result should be a documented environment mapping with observed behavior, not an assumption that any file named google-services.json is interchangeable.
Sources and further reading
- Firebase: Add Firebase to an Android project
- Android Developers: Configure your build
- Android Developers: Configure build variants
Reference review: 29 September 2026. Examples illustrate the workflow; check your installed versions, release artifact and account-specific Console requirements before applying them. This guide is not a claim that APKLint executed your project or verified your private account.
Android inspection tools and practical release guides. About APKLint · Report a correction
