Data and permissions
Google retired the legacy FCM HTTP and XMPP server APIs in June 2024, so sending messages now requires the HTTP v1 API, authenticated with short-lived OAuth2 access tokens generated from a Firebase service account rather than the old static server key — integrations still using the legacy key-based calls will fail outright. Each app instance is identified by a registration token rather than a phone number or user ID, and that token can rotate or expire, so apps need to listen for Android's onNewToken callback (or the iOS/web equivalent) and push refreshed tokens back to your server.
Practical Details
FCM distinguishes notification payloads, which the OS displays automatically when the app is backgrounded, from data payloads, which your app code must handle explicitly — mixing the two up is a common cause of messages that "work in the foreground but not when the app is killed." iOS delivery depends on an APNs authentication key or certificate being uploaded in the Firebase console, since FCM bridges Android-style messages through Apple's own push network rather than delivering to iOS devices directly.
Actionable Considerations
- Migrate any code still calling the legacy HTTP or XMPP endpoints to the HTTP v1 API with service-account OAuth2 tokens, since the old endpoints are shut down.
- Handle token-refresh callbacks in your app and keep your backend's stored tokens in sync, since a stale registration token silently drops messages.
- Upload a valid APNs key in the Firebase console and test delivery to killed/backgrounded iOS apps separately, since notification vs. data payload handling differs by app state.