FCM Token and Push Identity API

Before you start

• Firebase push enabled in a rebuilt Android app
• A stable non-secret user or account identifier

Configure and verify

1. Let the app register its token

   On startup, Firebase provides an FCM token and the generated app posts it to /api/apps/{app_id}/push/register.

2. Attach an identity after login

   Call webtoapp.setPushIdentity("customer-123") after your website establishes an authenticated user session.

3. Refresh identity when accounts change

   Set the new stable identity after login or account switching. Avoid email addresses when an internal opaque ID is available.

4. Target the identity

   Choose Selected identity in Push Notification or send recipient_identity through the authenticated push endpoint.

5. Handle token rotation

   The app re-registers refreshed FCM tokens; the backend updates the stored record by token hash.

Bridge example

if (window.webtoapp) {
  webtoapp.setPushIdentity("customer-123");
}

Public registration endpoint

The APK registration endpoint does not require dashboard authentication because devices must register themselves. It validates app existence and token shape, then stores the token for that app.

Identity design

Test before release

• Identity is set only after website login
• No password or secret is used as identity
• A selected-identity test reaches the correct device
• Sign-out behavior is defined