I am a person with no knowledge of app/server security.
I've been using only SHA-1 as many documentations have told me.
But I've always seen SHA-256 appear whenever I extract SHA-1 from Android Studio, and I've known that I can actually put sha-256 in google-services.
So my question is, what should I use SHA-1 or SHA-256? Which one is better? Can I use both at once?
-- EDIT
Google-services.json with only SHA-256 without SHA-1 key doesn't seem to work with Firebase Authentication.