So far I've signed all my apps (private key) with the same key/different package name to Google Play. All working fine.
Today I've added a new project in the firebase console. To use the auth service I've added the SHA-1 fingerprint. It was rejected because it was used in my other project.
I thought different package names with the same private key will lead to a different SHA-1 fingerprints. Am I wrong here?
The SHA-1 hash is not related to the package name, only the signing key. If firebase doesn't allow two projects to use the same hash then you will need to use a different key.
You can use #SignKeyFile and #SignKeyPassword to manage the keys.