Mobile SDK push keys: Firebase (FCM) and APNs

Last updated: 9 October 2026 · 7 min read

Steps

1. 1

   Android: get the service account JSON

   The dashboard needs the service account JSON, not google-services.json. google-services.json goes into the app and only names the project. The service account JSON is a secret key that lets Clomni's server send pushes through your project.

   1. In the Firebase console, open the project your app's google-services.json belongs to. Push only works when both files come from the same project.
   2. The gear next to “Project Overview” › Project settings › Service accounts.
   3. Under “Firebase Admin SDK”, “Generate new private key”, then “Generate key”. A JSON file downloads.

   Keep the file like a password: do not commit it, do not e-mail it. If it leaks, delete the key in Google Cloud Console › IAM › Service accounts › Keys and upload a new one. The Firebase Cloud Messaging API (V1) is on in new projects. If it is off, “Test push” returns an FCM error: turn it on in Google Cloud Console › APIs & Services.

2. 2

   Android: upload it

   Push › “Android · Firebase Cloud Messaging” › “Service account JSON file” › choose the file › “Upload”. The card then shows “Project” and the “Uploaded” date. If you see “The file has no project_id. Choose the service account file Firebase gave you.”, the wrong file was chosen: usually google-services.json. “The file is not JSON” and “The file's private_key cannot be read” also mean a wrong or damaged file.

3. 3

   iOS: create the APNs key

   You need the Account Holder or Admin role in the Apple Developer Program.

   1. developer.apple.com/account › Certificates, Identifiers & Profiles › Keys › +.
   2. Name the key, tick “Apple Push Notifications service (APNs)”, “Configure”.
   3. Choose Environment: Sandbox & Production. Key Restriction: “Team Scoped (All Topics)”. “Save” › “Continue” › “Register”.

   The environment matters. A Sandbox-only key works in builds run from Xcode, not in TestFlight or the App Store. A Production-only key is the other way round. Either way APNs answers BadEnvironmentKeyInToken and the push does not arrive. Keys created before Apple added the environment choice work in both.

4. 4

   iOS: get the file and the IDs

   • “Download” on the key's page: the .p8 file can be downloaded only once. If it is lost, make a new key.
   • Key ID: under the key's name, 10 characters.
   • Team ID: developer.apple.com/account › Membership details, 10 characters.
   • Bundle ID: the app's Bundle Identifier (Xcode › target › Signing & Capabilities), for example com.example.app.
5. 5

   iOS: upload it

   Push › “iOS · Apple Push Notification service”: “.p8 file” (AuthKey_XXXXXXXXXX.p8), “Key ID”, “Team ID”, “Bundle ID”, then “Upload”. The dashboard checks the format (Key ID and Team ID are 10 letters or digits). Whether Apple accepts the key is known at the first push: send a “Test push”.

6. 6

   Test push

   Once the app has run on a phone with notifications allowed and passed its token, the device shows up in the “Test push” list: platform, model, app version and, on iOS, the APNs environment (sandbox or production). Choose the device and click “Send”. “Title” and “Text” are optional: left empty, the title style and a sample text are used, and the “Preview” on the right shows how the notification will look. The answer is FCM's or APNs' own:

   • “Sent”: the notification is on its way. If nothing shows on the phone, check the app's push code.
   • BadEnvironmentKeyInToken (APNs): the key is limited to the other environment. Make and upload a Sandbox & Production key.
   • InvalidProviderToken (APNs): the Key ID or Team ID is wrong, or the key was revoked. Check the IDs and upload the key again.
   • DeviceTokenNotForTopic (APNs): the Bundle ID in the Push section is not the app's.
   • BadDeviceToken (APNs): the token is another app's or no longer valid. Reinstall the app, open it, allow notifications.
   • SENDER_ID_MISMATCH (FCM): the service account is from a different Firebase project than google-services.json. Upload the service account of the app's project.
   • UNREGISTERED (FCM): the app was removed from the device or the token expired. Open the app again so it sends a new token.
   • “Not sent”, no key: no key is uploaded for this platform.

   Clomni deletes tokens APNs or FCM report as dead. “Last 7 days” in the Push section counts pushes sent, failed, removed tokens and skipped (no key). When FCM or APNs refuses the key itself, a warning shows up on “Overview”.

7. 7

   Full guide

   • PDF: Clomni Mobile SDK guide, in English, Azerbaijani and Russian.
   • Online: Push keys.
   • In the dashboard: “Guide” in the channel's settings column.