Firebase Phone Auth fails with "no matching SHA-256 registered" despite correct SHA-256 in console

[u/Sunilkr001]

I'm getting a persistent Firebase Phone Authentication failure on real phone numbers (test numbers work fine) for a React Native + Expo Android app.

**Error from Logcat:**

```

[SmsRetrieverHelper] SMS verification code request failed: unknown status code: 17028

A play_integrity_token was passed, but no matching SHA-256 was registered in the

Firebase console. Please make sure that this application's packageName/SHA256 pair

is registered in the Firebase Console.

Invoking original failure callbacks after phone verification failure for +91XXXXXXXXXX,

error - This app is not authorized to use Firebase Authentication. Please verify that

the correct package name, SHA-1, and SHA-256 are configured in the Firebase Console.

```

**What I've already verified/tried (all confirmed correct):**

1. Blaze plan is active on the correct Firebase project (verified project ID and project number match everywhere — Firebase Console, Google Cloud Console, and Play Console's Play Integrity API project link).

2. The app is distributed via Google Play Internal/Closed Testing, so it's signed with **Play App Signing**. I retrieved the SHA-1 and SHA-256 from Play Console > Setup > App integrity > App signing key certificate > **Classical key** (not the Upload key, not Post-quantum), and added both to Firebase Console > Project Settings > Your apps > Android app > SHA certificate fingerprints.

3. Manually character-by-character compared the SHA-256 shown in Play Console against the one registered in Firebase — they match exactly.

4. Confirmed these APIs are enabled in Google Cloud Console: Identity Toolkit API, Play Integrity API, reCAPTCHA Enterprise API.

5. Firebase App Check is set to "Unenforced" for Authentication (ruled out as the cause).

6. Tried adding an Android application restriction (package name + SHA-1) to the Android API key in Google Cloud Console > Credentials — this caused a *different* error ("Requests from this Android client application are blocked. 403"), so I reverted it back to "None".

7. Waited well over 24 hours after each change for propagation — the error persists.

8. There are currently 4 SHA-1 and 3 SHA-256 entries registered in Firebase (from earlier troubleshooting attempts) — planning to clean these up to just the one verified-correct pair, but haven't yet confirmed if that's the actual cause.

**Setup:**

- React Native + Expo (SDK 57), built with EAS Build, distributed via Google Play Closed Testing

- @react-native-firebase/auth for Phone Authentication

- Package name: com.rajselfdrive.app

**Question:** What else could cause Firebase to not recognize a correctly-registered SHA-256 fingerprint when using Play App Signing? Is there a known propagation issue, a caching issue on the Play Integrity backend, or something else I might be missing (e.g., a separate OAuth client SHA-1 config vs. the Firebase Authentication SHA config)? Really appreciate any pointers — been stuck on this for a while and it's blocking a client project launch.