What Bearer token should I be using for Firebase Cloud Messaging testing?

Question

I am trying to send a test notification using Firebase Cloud Messaging via Postman. I'm doing a POST to this url

https://fcm.googleapis.com/v1/projects/[my project name]/messages:send

The Authorization tab in Postman is set to No Auth and my Headers tab looks like this

Content-Type: application/json
Authorization: Bearer [server key]

[server key] is a newly generated server key in the 'Cloud Messaging' tab of my Firebase project's 'Settings' area. I keep getting this error in response.

"error": {
    "code": 401,
    "message": "Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.",
    "status": "UNAUTHENTICATED"
}

Based on everything I can find, I'm using the right token, but it seems Google disagrees. What should I be sending as the Authorization header to get past this error?

Solution 1

Steps to get Authentication Bearer:

1. Got to Google OAuth Playground: https://developers.google.com/oauthplayground
2. In the "Input your own scopes" for FCM use this url: https://www.googleapis.com/auth/firebase.messaging
3. Tap Authorize API.
4. Pick correct user for authorisation and allow access.
5. In the Step 2: Exchange authorization code for tokens tap Exchange authorisation code for tokens.
6. Access token is your Bearer.

Steps to send FCM throw Postman:

1. URL to send: https://fcm.googleapis.com/v1/projects/projectid-34543/messages:send
2. Request Type: POST
3. Headers: Content-Type -> application/json & Authorization -> Bearer
4. In the body section enter APS payload with the right device token.
5. Click send.

In case you want to use cURL, for a data-notification:

curl --location --request POST 'https://fcm.googleapis.com/v1/projects/your-project-id/messages:send' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer your-access-token-*****-wqewe' \
--data-raw '{
    "message": {
        "token": "device-token-qwfqwee-***-qefwe",
        "data": {
            "Key1": "val1",
            "Key2": "val2"
        }
    }
}'

Solution 2

You have to generate new access token in Postman.

First, ensure you have enabled FCM API in Google Developer Console. Than go to Google Developer Console -> APIs & Services -> Credentials. Look at "OAuth 2.0 client IDs" section. There should be at least one item in list. Download it as json file.

In Postman open "Authorization" tab, select Type = "OAuth 2.0" than click "Get New Access Token". Dialog appears.

Fields:

Token Name - type what you want

Grant Type = Authorization Code

Callback URL = redirect_uris from downloaded json

Auth URL = auth_uri

Access Token URL = token_uri

Client ID = client_id

Client Secret = client_secret

Scope = "https://www.googleapis.com/auth/firebase.messaging"

State - leave empty

Client Authentication = default, Send As Basic Auth Header

Click "Request Token" and that's it.

Solution 3

The Bearer Token is the result of getting an OAuth access token with your firebase service account.

1. Get yourself a Firebase service account key.
   Go to your firebase console > Settings > Service Accounts.
   If your on Firebase Admin SDK generate new private key.

2. You use the service account key to authenticate yourself and get the bearer token.
   Follow how to do that in Node, Python or Java here: https://firebase.google.com/docs/cloud-messaging/auth-server.

So in Java you can get the token like this:

  private static final String SCOPES = "https://www.googleapis.com/auth/firebase.messaging";

  public static void main(String[] args) throws IOException {
    System.out.println(getAccessToken());
  }

  private static String getAccessToken() throws IOException {
    GoogleCredential googleCredential = GoogleCredential
        .fromStream(new FileInputStream("service-account.json"))
        .createScoped(Arrays.asList(SCOPES));
    googleCredential.refreshToken();
    return googleCredential.getAccessToken();
  }

3. And now you can finally send your test notification with FCM.

Postman code:

POST /v1/projects/[projectId]/messages:send HTTP/1.1
Host: fcm.googleapis.com
Content-Type: application/json
Authorization: Bearer access_token_you_just_got

{
  "message":{
    "token" : "token_from_firebase.messaging().getToken()_inside_browser",
    "notification" : {
      "body" : "This is an FCM notification message!",
      "title" : "FCM Message"
      }
   }
}

Solution 4

You should use definitely use Google-OAuth2.0, which can be generated using described steps in the provided link.

you can find detailed steps here, which I answered for similar question.

Solution 5

To generate an for testing push notification, you can use Google Developers OAuth 2.0 Playground

You can even send a test Push Notification using Google Developers OAuth 2.0 Playground itself. Or if you want can use Postman / Terminal (curl command) as well.

Please find the detailed steps here, which I wrote.

Note : Instead of "Project name" in the Endpoint, you have to use "Project ID". Steps for getting the Project ID is also mentioned in the above link.

View more solutions

Comments

[Luis Abarca]

That works for me ! and also you have to activate FCM API

[Ramis]

Not working any more. Getting that "browser is insecure"

[Kim Carlo]

does the access token expire?

[Apoorv]

@KimCarlo Yes, it will expire. If you notice the screenshot, it says ("The access token will expire in 3586 seconds"). However, you can click "Auto-refresh the token before it expires" or manually do "Refresh access token".

[Muhammad Asyraf]

omg the gif image giving a hard time to understand

[morfair]

How to get code programmatically (in backend)?

[morfair]

How get bearer token without Admin SDK?

[Ramis]

@morfair can not answer as I am not backend developer.

[Fingolfin]

This is a great answer, most thorough by far. Thanks!

[BIS Tech]

@Ramis IThanks. I got an access token. Is this token forever?

[Ramis]

@BloodLoss It is short living token.

[BIS Tech]

@Ramis okay. It's mean, I have to use this kind of way to get token?stackoverflow.com/a/52265305/8822337

[Ramis]

@BloodLoss If token expiries, then you need to get a new token. I used this token when I was testing push notifications throw Firebase.

[Abner]

Thks a lot had a very hard time to find how to generate the bearer token. The steps provided worked just fine.

[thomasgalliker]

Is there a way to get the bearer token without the need of having Google.Apis.Auth Nuget Package referenced?

[Sanjay Kumar]

Worked. But Need a solution to build through any API.

[Eric]

How do you generate tokens for production though? Obviously you can’t manually do this for users…

[Ramis]

@Eric I do not know. Here should be instructions somewhere. One of them: medium.com/fantageek/…