Skip to main content

Getting your Firebase (FCM) credentials (Android)

Joryio sends push notifications to Android devices through Firebase Cloud Messaging (FCM), using the FCM HTTP v1 API. To do that it needs a service account key from the Firebase project your Android app uses. This page walks through setting up Firebase, generating the key, and entering it in Joryio.

Each Joryio app holds its own push credentials, so you do this once per Android app. A React Native or Unity project has a separate Android app in Joryio - its FCM credentials go there. See Multi-Platform Tracking.

What Joryio asks for​

Field in JoryioWhat it isRequired
Firebase service account (JSON)The private key file of a service account in your Firebase project. Joryio sends every Android push with it.Yes
Sender IDNumeric identifier of your Firebase project. Joryio stores it but does not use it to send.No - you can leave it empty

Joryio supports only the service account JSON (FCM HTTP v1). The legacy FCM "server key" is not supported - Google has retired the legacy FCM APIs, and a send from an Android app that has only a server key fails.

iOS devices are not sent through Firebase: Joryio sends to iOS directly through APNs. See Getting your APNs credentials.

Before you start​

  • A Firebase project. Create one in the Firebase console if you do not have one.
  • Permission to create service account keys in that project. Google Cloud grants this through the Service Account Key Admin role (roles/iam.serviceAccountKeyAdmin); project Owners usually have it. If your Google Cloud organization enforces the iam.disableServiceAccountKeyCreation policy, key creation is blocked - this is enforced by default for organizations created on or after May 3, 2024. Ask your Google Cloud administrator to exempt the project.
  • An Android app in Joryio with the Android SDK integrated. To create one, see Creating Apps.

Step 1: Add your Android app to Firebase​

Your app needs Firebase so that devices can get an FCM registration token. Skip this step if your app already uses Firebase.

  1. In the Firebase console, open your project.
  2. On the project overview page, click the Android icon or Add app.
  3. Enter your app's Android package name (the applicationId in your module-level Gradle file). It is case-sensitive and cannot be changed after you register.
  4. Click Register app.
  5. Click Download google-services.json and move the file into your app module's root directory (usually app/).
  6. Add the Google services Gradle plugin, as the Firebase console shows:
    • In your root-level Gradle file: id("com.google.gms.google-services") version "<version>" apply false
    • In your module-level (app) Gradle file: id("com.google.gms.google-services")
  7. Finish the push setup in your app as described in the Android SDK push section.

google-services.json contains identifiers for your app, not secrets, and it ships inside your app. It is not the file Joryio needs - that is the service account key in the next step.

Step 2: Generate the service account key​

  1. In the Firebase console, click the gear icon (Settings), open Project settings, then the Service accounts tab.
  2. Click Generate New Private Key, then confirm with Generate Key.
  3. A JSON file downloads. Store it securely - you cannot download the same key file again. If you lose it, generate a new key.

The file contains, among other fields, "type": "service_account", project_id, private_key, and client_email.

Step 3: Enter the credentials in Joryio​

  1. In the Joryio dashboard, go to Settings → Apps.
  2. Find your Android app in the list and click the Push Notifications (bell) icon on its row. The Push notifications - [app name] page opens.
  3. In the Firebase Cloud Messaging card, click Upload service account JSON and choose the file from step 2. Joryio shows the project ID it read from the file under the button. Check that this is the same project as the project_id in your app's google-services.json.
  4. Optional: enter the Sender ID. Joryio does not use it to send, so you can leave it empty.
  5. Click Save configuration.

The apps list now shows FCM configured under the app's name. The service account is encrypted at rest and is never shown again: when you reopen the page, it shows "Configured - leave blank to keep the current value, or enter a new one to replace it." Upload a file only when you want to replace the saved one.

Step 4: Send a test push​

  1. Install your app on a device or emulator with Google Play services, open it, and allow notifications (Android 13 and later asks for the notification permission). The SDK registers the device's FCM token with Joryio.
  2. Create a push campaign (or open a draft) that sends from this app.
  3. Click Send test push on the variant, choose the user who is signed in on your device, and send.

If the test fails, the error message includes the reason FCM returned - look it up in the table below. See Push Notifications for the full campaign flow.

Common errors and fixes​

What you seeLikely causeFix
"That does not look like a Firebase service account JSON (missing project_id / private_key / client_email)."The uploaded file is not a service account key - most often google-services.json.Upload the file from Project settings → Service accounts → Generate New Private Key (step 2).
"Could not parse that file as JSON."The file is damaged or is not JSON.Generate a new key and upload the new file unchanged.
"FCM not configured: this app needs a Firebase service account (the legacy server key is no longer supported)"The app has no service account saved - for example only a legacy server key.Upload a service account JSON and save.
"Device token sender mismatch" (messaging/mismatched-credential or messaging/sender-id-mismatch)The device token was issued for a different Firebase project than the service account.Use a service account from the same project as the google-services.json in your app build, then open the app on the device again so it registers its token again.
"Device token unregistered" (messaging/registration-token-not-registered)The app was uninstalled or the token is no longer valid.Nothing to fix in the credentials. Joryio stops sending to that token.
Authentication or permission errorsThe key was deleted or disabled in Google Cloud, or the service account lost its permissions.Generate a new key in Firebase and upload it.
"no device accepted the notification"The user has no registered Android device for this app.Open the app on the device with the SDK integrated, allow notifications, and make sure you test with the same user.

Security and rotation​

  • Treat the service account JSON as a secret: it holds a private key that can send messages to your app's users and call other Google APIs the service account is allowed to use. Do not commit it to source control or send it by email or chat, and do not ship it inside your app.
  • If you think the key has leaked, generate a new key, upload it in Joryio, then delete the old key in the Google Cloud console: IAM & Admin → Service accounts, click the service account, open the Keys tab, and delete the old key. A deleted key cannot be restored.
  • To rotate the key without downtime, do it in the same order: new key in Joryio first, delete the old one second.