Android platform

On Android, capacitor-auth-manager runs native Google sign-in through GoogleSignIn (the account chooser @codetrix-studio/capacitor-google-auth used) and falls back to the Credential Manager API when GoogleSignIn fails for any reason other than a cancel. The same auth.signIn(AuthProvider.GOOGLE) call you use on web and iOS runs here too. Native Android support requires Capacitor (@capacitor/core ^7.4.2 or ^8), and yarn cap sync.

Google-first (3.x)

Google is the only enabled provider. Other providers are excluded from the published native sources — auth.signIn() with a non-Google id throws AuthErrorCode.PROVIDER_NOT_ENABLED.

Setup

1. In Google Cloud / Firebase, create an Android OAuth client and add every signing SHA-1/SHA-256: the debug key, the upload key (locally signed APKs) and the Play App Signing key (every Play-installed copy is re-signed with it). Create (or reuse) a Web OAuth client.
2. Pass that Web client id as serverClientId — Google returns no id token without it. If you finish sign-in in Supabase, it must be in the Google provider's client list.
3. No google-services.json is needed by this plugin — it uses no Firebase native SDK.
4. The default androidFlow: 'auto' (since 3.1.0) shows GoogleSignIn's account chooser, which can also add an account. If GoogleSignIn fails for any reason other than a cancel, it falls back to Credential Manager (the bottom sheet, then the Sign in with Google button). Pin one path with 'legacy', 'credential-manager', 'bottom-sheet' or 'button', in the provider options or per call.
5. Every native error names Google's own status, and a configuration error adds the installed package and signing SHA-1. Read them with adb logcat -s CapacitorAuthManager (warnings and errors are always logged since 3.1.1).

3.0.0 on Play builds

3.0.0 ran Credential Manager alone, and Play-installed builds failed with an error and no account picker. Upgrade to 3.1.1. Do not force com.google.android.gms:play-services-auth 22.x in your app: 22.0.0 removed GoogleSignIn, so the package pins 21.6.0.

The plugin declares only INTERNET. Nothing else is merged into your manifest.

import { auth, AuthProvider } from 'capacitor-auth-manager';

auth.configure({
  providers: {
    [AuthProvider.GOOGLE]: {
      clientId: 'YOUR_WEB_OAUTH_CLIENT_ID',
      serverClientId: 'YOUR_WEB_OAUTH_CLIENT_ID', // REQUIRED for an idToken
    },
  },
});

const result = await auth.signIn(AuthProvider.GOOGLE);
// Android returns an idToken reliably; accessToken / serverAuthCode come from the
// separate Google Authorization API, not the sign-in call.
const idToken = result.credential.idToken;

Hand idToken to Firebase with signInWithCredential(getAuth(), GoogleAuthProvider.credential(idToken)). The web popup returns an access token instead; see the Firebase integration guide.

Native source

The Google native path lives in GoogleAuthProvider.java on top of shared scaffolding — BaseAuthProvider.java, ProviderFactory.java, AuthStorage.java, AuthLogger.java, and the plugin entry points CapacitorAuthManager.java and CapacitorAuthManagerPlugin.java. Package CI compiles native consumers. Validate real Google sign-in with your OAuth clients on a device before rollout.

Secure storage

Storage adapters persist profile/session metadata, not bearer credentials. Android tokens stay in memory. Legacy package credential storage is removed on upgrade. CapacitorPreferencesStorage is optional metadata storage and is not encrypted. See Storage.

import { auth, CapacitorPreferencesStorage } from 'capacitor-auth-manager';

auth.configure({
  storage: new CapacitorPreferencesStorage(),
  providers: { google: { clientId: 'YOUR_CLIENT_ID' } },
});

Errors

Native failures reach JavaScript with a real AuthErrorCode (since 3.0.0), so you can branch on error.code rather than on message text:

Situation	Code
the user dismissed the bottom sheet or the button flow	auth/user-cancelled
no Google account on the device, and the button flow could not add one	auth/sign-in-failed
the request was interrupted (Play services restarted, connectivity lost)	auth/network-error
serverClientId (your Web OAuth client id) is missing	auth/missing-configuration
the credential could not be parsed as a Google ID token	auth/invalid-credentials
a silent refresh could not produce a token	auth/token-refresh-failed

Related

• Installation
• Providers overview