In my case, I created new game from developer console -> Game Services -> Add New Game before I publish the game in Play Store.
When it asks me for my SHA1 key, I entered the key which gradle generates for me (in Android Studio, open Gradle tab and double click PROJECT/Tasks/Android/singingReport. It will show you SHA1 keys for debug and release)
After that, developer console created project in API console for me (in console.developers.google.com/apis/dashboard). For my SHA1 key, it generated Client ID
Then I published the game in Play Store and use Google Play App Signing. Because of this, Google generated a different SHA1 key for me. (You can see that SHA1 in developer console (PROJECT/Release Management/App Signing). It uses SHA1 in "App Signing Certificate"
This SHA1 key also added in API console automatically, but obviously different client ID generated.
Then I go to the Game Services/PROJECT/Linked Apps in developer console and check "OAuth2 Client ID" at the end of the page. It matches with client ID in API Console which is paired with SHA1 Key I entered before I publish the app (not the new one)
At the end, I delete my API Console project by doing these steps and make all the step above from scratch. Finally it works!