Firebase: push, Remote Config & Crashlytics

01How push notifications actually work

Your server never talks to a phone directly. On iOS the operating system keeps one connection to APNs (Apple Push Notification service); on Android, Google Play services keeps one connection to FCM. When your app starts, it asks the OS for a device token — an address for this app on this device — and sends it to your backend, linked to the user. To notify the user, your backend calls the FCM HTTP v1 API with that token; FCM delivers directly on Android and forwards to APNs for iOS (you upload an APNs auth key to Firebase once). Tokens change: after reinstall, restore or periodically, so listen for token refresh and update the backend. When FCM reports a token as unregistered, delete it. One user can have several devices, so store many tokens per user.

• Device token: address of one app install, not of a person
• APNs auth key (.p8) uploaded to Firebase for iOS delivery
• FCM HTTP v1 API with a service account; the legacy API is gone
• Topics: send one message to many subscribers (e.g. 'promo-hy')

02Permissions and getting the token

iOS always needs user permission to show notifications, and Android needs the POST_NOTIFICATIONS runtime permission from Android 13 (API 33). If a user taps 'Don't allow', you usually cannot ask again — they must go to Settings. So ask at a moment the value is obvious: after the first order ('Get notified when your coffee is ready?'), not on the first screen. Show a short in-app explanation before the system dialog. iOS also supports provisional authorization, which delivers quietly to the notification centre without a prompt. With React Native Firebase the flow is: request permission, get the token, send it to your API with the platform and app version, and subscribe to token refresh.

1import { getMessaging, requestPermission, getToken, onTokenRefresh,
2  AuthorizationStatus } from "@react-native-firebase/messaging";
3import { PermissionsAndroid, Platform } from "react-native";
4 
5export async function registerForPush(api: Api) {
6  const messaging = getMessaging();
7  if (Platform.OS === "android" && Platform.Version >= 33) {
8    await PermissionsAndroid.request("android.permission.POST_NOTIFICATIONS");
9  }
10  const status = await requestPermission(messaging);
11  if (status === AuthorizationStatus.DENIED) return;
12 
13  const token = await getToken(messaging);
14  await api.post("/devices", { token, platform: Platform.OS });
15  onTokenRefresh(messaging, (t) => api.post("/devices", { token: t, platform: Platform.OS }));
16}

03Notification vs data messages, foreground and taps

An FCM message can carry a notification block (title, body), a data block (your own key-value strings), or both. Notification messages are displayed by the OS automatically when the app is in the background or killed. Data-only messages are delivered to your code, which decides what to do; on iOS they are background pushes that the system may throttle or delay, so never rely on them for user-visible alerts. When the app is in the foreground, the OS does not show the banner by default: you receive it in onMessage and decide — show an in-app toast, update a badge, or display a local notification with Notifee. Handle taps in three states: foreground, background (onNotificationOpenedApp) and cold start (getInitialNotification). Put a deep-link route in data and navigate with it.

1{
2  "message": {
3    "token": "DEVICE_TOKEN",
4    "notification": { "title": "Order ready", "body": "Your latte is waiting at the counter" },
5    "data": { "type": "order_status", "orderId": "1042", "link": "app://orders/1042" },
6    "android": { "priority": "high", "notification": { "channel_id": "orders" } },
7    "apns": { "payload": { "aps": { "sound": "default" } } }
8  }
9}

04Sending from the backend reliably

Send pushes from a queue worker, not inside the HTTP request: an order-status change writes a job, and the worker calls FCM with retries and backoff. Use the Firebase Admin SDK or the HTTP v1 endpoint with a service-account credential stored as a secret on the server — never in the app. Save every campaign or message in your own database too, so the app can show an in-app inbox; pushes are not guaranteed to arrive and users clear them. Respect quiet hours and user preferences (order updates on, marketing off), and on Android create separate notification channels so users can mute promotions without losing order updates. Clean up tokens that FCM returns as unregistered. For mass campaigns, use topics or batched sends and schedule them through your own job system.

05Remote Config: force update, maintenance, feature flags

Remote Config is a set of key-value parameters stored in Firebase that the app fetches at runtime. You ship defaults inside the app, fetch and activate on launch with a sensible minimum fetch interval, and read values as booleans, numbers or strings. Conditions let you target by platform, app version, country or percentage of users. Three uses pay for themselves. Force update: store min_supported_version per platform; if the installed version is lower, show a blocking screen with a store link — essential when an old app would break against a new API. Maintenance mode: a flag that shows a friendly screen during migrations. Feature flags and gradual rollout: enable a new checkout for 10% of users, watch Crashlytics, then go to 100%. Keep logic safe if fetch fails: the app must work on defaults.

1import { getRemoteConfig, setDefaults, setConfigSettings,
2  fetchAndActivate, getValue } from "@react-native-firebase/remote-config";
3import { Platform } from "react-native";
4import DeviceInfo from "react-native-device-info";
5 
6export async function checkAppGate() {
7  const rc = getRemoteConfig();
8  await setDefaults(rc, { min_version_ios: "1.0.0", min_version_android: "1.0.0", maintenance: false });
9  await setConfigSettings(rc, { minimumFetchIntervalMillis: 15 * 60 * 1000 });
10  await fetchAndActivate(rc).catch(() => undefined); // offline: use cached/defaults
11 
12  const key = Platform.OS === "ios" ? "min_version_ios" : "min_version_android";
13  if (getValue(rc, "maintenance").asBoolean()) return "maintenance";
14  if (isLower(DeviceInfo.getVersion(), getValue(rc, key).asString())) return "force_update";
15  return "ok";
16}

06Crashlytics and Analytics

Crashlytics collects native crashes and, with React Native Firebase, JavaScript errors you record, grouped by issue and tied to app version and device. Make sure symbol files (dSYMs on iOS, mapping files on Android) are uploaded during the build, or stack traces stay unreadable. Add context: set a non-personal user ID, log breadcrumbs before risky steps (payment start, payment return), and record handled errors from API failures that matter. Watch the crash-free users rate per release; during a staged rollout it is your signal to pause. Analytics records events such as screen_view, add_to_cart, begin_checkout and purchase. Define a small event plan with consistent names before coding, avoid sending personal data, and respect consent: disable collection until the user agrees where the law requires it.

07Delivery internals: priority, TTL, collapsing and Doze

Delivery is shaped by power management. Android's Doze mode batches network access for idle phones; normal-priority FCM messages wait for a maintenance window, while high-priority messages can wake the device. Google may deprioritise apps whose high-priority messages do not lead to a visible notification, so use high priority only for alerts the user sees. On iOS, apns-priority 10 means deliver now and 5 means deliver when convenient; background (content-available) pushes must use priority 5 and are throttled by the system. Every message has a lifetime: android.ttl and the apns-expiration header decide how long the service keeps trying an offline device. A collapse key (Android) or apns-collapse-id (iOS) replaces older undelivered messages with the newest one, so a phone that comes back online shows one 'cart updated' message, not ten. Keep payloads small: FCM rejects messages above about 4 KB.

1{
2  "message": {
3    "token": "DEVICE_TOKEN",
4    "data": { "type": "cart_sync", "cartId": "c_981" },
5    "android": { "priority": "normal", "ttl": "3600s", "collapse_key": "cart" },
6    "apns": {
7      "headers": {
8        "apns-priority": "5",
9        "apns-push-type": "background",
10        "apns-collapse-id": "cart"
11      },
12      "payload": { "aps": { "content-available": 1 } }
13    }
14  }
15}

08Sending at scale: batching, errors and quotas

The Firebase Admin SDK sends a list of up to 500 tokens in one call with sendEachForMulticast, returning one result per token in the same order. Classify every failure. registration-token-not-registered means the app was uninstalled or the token rotated: delete it. invalid-argument means your payload is wrong: fix the code, do not retry. Quota-exceeded (HTTP 429) and unavailable or internal errors (503, 500) are temporary: retry with exponential backoff and respect a Retry-After header. Project-level quotas exist, so large campaigns should go through a queue that paces sends instead of a loop that fires everything at once. Pacing also protects your own backend: if 200,000 people receive a promotion in the same second, many will open the app in the same minute.

1import { getMessaging } from "firebase-admin/messaging";
2 
3export async function sendToUser(tokens: string[], title: string, body: string, link: string) {
4  const res = await getMessaging().sendEachForMulticast({
5    tokens, // up to 500 per call
6    notification: { title, body },
7    data: { link },
8  });
9 
10  const dead = res.responses
11    .map((r, i) => (r.error?.code === "messaging/registration-token-not-registered" ? tokens[i] : null))
12    .filter((t): t is string => t !== null);
13 
14  await removeTokens(dead); // keep the token table clean
15  return { sent: res.successCount, failed: res.failureCount };
16}

09Privacy and security of notifications

A notification is shown on a lock screen, mirrored to watches and sometimes read aloud, so treat its text as public. Never put one-time codes, balances, health details or full addresses in the title or body; say 'Your order has an update' and show details inside the app after authentication. On iOS a Notification Service Extension can decrypt an encrypted payload or download rich media before display (mutable-content), which lets you send less sensitive data through Apple's and Google's servers. The service-account credential that sends pushes is powerful: give it only the Firebase Cloud Messaging roles it needs, keep it in a secret store and rotate it. Device tokens are not secrets, but they are personal data linked to a user: unlink them on sign-out and delete them when an account is deleted.

10Remote Config internals and pitfalls

Remote Config is client-side configuration, not a security boundary: values are downloaded to the device and can be read or altered there, so never store secrets in it or use it to grant permissions — the server must enforce access. The SDK caches values and throttles fetches; the default minimum fetch interval is 12 hours, so lower it deliberately and avoid fetching on every screen. Decide how values activate: fetchAndActivate at launch is simple but can change the UI after it appears; fetching in the background and activating on the next launch avoids flicker. Real-time Remote Config can push changes to running apps when you need fast kill-switches. Percentage conditions are stable per app installation, so the same user stays in the same group. Every publish creates a template version you can roll back, which is useful when a bad value breaks something.