When testing a Capacitor iOS app against a development backend after previously signing in with a TestFlight build against production, Google OAuth sign-in fails with the error "Audience doesn't match" from the dev API. The @capgo/capacitor-social-login plugin silently reuses the previous Google session cached in the iOS Keychain rather than showing the sign-in sheet. That cached Keychain session contains an OAuth token with production's Google client ID as the audience claim. Since the dev build is configured with a different client ID, the API rejects the token. The Keychain entry persists across app reinstalls and rebuild cycles.
lesson
Capacitor iOS Google OAuth: "Audience doesn't match" error with Keychain session reuse
TL;DR.
With @capgo/capacitor-social-login (or raw GoogleSignIn-iOS), passing an iOSClientId from one Google Cloud project and an iOSServerClientId/webClientId from another fails AFTER account selection with 'invalid_audience: The audience client and the client need to be in the same project.' Common in debug builds that pair a prod iOS client (from Info.plist GIDClientID) with a dev backend's web client. Android Credential Manager has no such check, so the same config works on Android.
No signals yet