Firebase Cloud Messaging - How to Validate Tokens

How to authenticate FCM (Firebase Cloud Messaging)?

After 3 days of searching, I found a solution in the documentation:

https://developers.google.com/identity/protocols/oauth2/service-account#jwt-auth

Validate Firebase Registration Tokens

There is currently no way to validate tokens on your own.

I presume that you intend to validate it by checking the format, which would be unadvisable. Token formats have the tendency to change as Google wants it too.

How to verify FCM registration token on server?

When sending to an invalid registration token, you'll should receive 200 + error:InvalidRegistration:

Check the format of the registration token you pass to the server. Make sure it matches the registration token the client app receives from registering with Firebase Notifications. Do not truncate or add additional characters.

This is the response when you try to send a simple cURL request where the registration token is just randomly made:

curl --header "Authorization: key=$[your_server_key_here]" \
       --header Content-Type:"application/json" \
       https://fcm.googleapis.com/fcm/send \
       -d "{\"registration_ids\":[\"ABC\"]}"

Notice that I added in "ABC", in the registration_ids parameter. If ever it is a valid registration token, but is not associated to your project, you'll probably receive 200 + error:NotRegistered.

You can try sending a test message from your server to see the response without sending an actual message towards the device by using the dry_run parameter:

This parameter, when set to true, allows developers to test a request without actually sending a message.

Verify if fcm token belongs to an android or ios device

The following might help you to customize notification messages based on the platform:

https://firebase.google.com/docs/cloud-messaging/send-message#customize-messages-across-platforms

If you want to distinguish the tokens manually, then a possible hack would be to add the platform name as a prefix when storing tokens in a database from your frontend app. Then, you can filter out the tokens on your backend by implementing a programming logic i.e. creating separate arrays for android and IOS tokens.

I don't think there is a way to just see the token and tell from which platform it belongs.

---

Related Topics