FCM: Android, and iOS apps on the FCM SDK

FCM is the provider for Android, and for iOS apps that use the FCM SDK (ios.provider: fcm). backd sends through FCM’s HTTP v1 API from the worker, with an OAuth2 access token it mints from a service account.

1. A Firebase project#

1. Open the Firebase console and create a project, or pick the one your app uses.
2. Android: add an Android app with your application id (the package name). Download google-services.json for the app’s build.
3. iOS over FCM: add an iOS app with the bundle id, download GoogleService-Info.plist, and upload an APNs authentication key under Project settings → Cloud Messaging → Apple app configuration (see APNs for where it comes from). That key lives in Firebase: backd never sees it.
4. In the linked Google Cloud project, enable the Firebase Cloud Messaging API (V1) (APIs & Services → Library). The legacy API is not used.

2. A service account#

1. Project settings → Service accounts → Generate new private key. A JSON file downloads: it holds project_id, client_email and private_key.
2. Store it as a realm secret, from the file:

backd secret set --realm acme --name FCM_SERVICE_ACCOUNT < service-account.json

The value is read from standard input, newlines included, and encrypted with the instance’s BACKD_SECRETS_KEY. Delete the downloaded file afterwards.

3. realm.yaml#

push:
  android:
    provider: fcm
    credentials: secret:FCM_SERVICE_ACCOUNT
  ios:
    provider: fcm                      # only for apps on the FCM SDK; APNs directly is `apns`
    credentials: secret:FCM_SERVICE_ACCOUNT

web can use provider: fcm too, for tokens from the FCM web SDK (not Push API subscriptions): the app registers the FCM token as the device’s token.

4. The network#

Requests go through the egress proxy of the deployment, with a token the worker signs for each delivery unit naming only these hosts:

Without a proxy (a single-process development setup) the worker dials them directly, and only public addresses. The worker needs EXECUTOR_PROXY and BACKD_EGRESS_KEY to use the proxy, like the executor.

What backd does with the answers#

The access token is cached until a minute before it expires, so a busy worker asks for one about once an hour.