Push notifications

Push is optional. Without it the app builds, runs and publishes normally: customers still see their notifications in the app's own inbox (the bell on the home screen), and a notification that arrives while the app is open is shown as a phone notification over the app's live connection. What push adds is delivery while the app is closed: the events that matter — money arriving, a withdrawal failing, a P2P trade waiting for a reply — reach the phone's lock screen whenever they happen.

The app ships as source, so push needs your own Firebase project. No configuration file for it can come with the package.

Two halves, one Firebase project

1. Create the Firebase project

Firebase is used for push and nothing else. The app contains no Firebase Analytics, Crashlytics or other tracking SDK.

2. The Android build

Put google-services.json in android/app/ and build. There is nothing else to change: the project applies Google's services plugin only when that file is present, and says which way it went on every build:

google-services.json found - Firebase push ENABLED
google-services.json not found - Firebase push DISABLED. The app builds and runs; see the note in android/app/build.gradle.kts to enable it.

The file must come from a Firebase Android app registered with your androidApplicationId. A file issued for any other id stops the build with No matching client found for package name. If you change the id, add an Android app with the new id in Firebase and download its file.

The app already declares Android's notification permission, so Android 13 and later show the system prompt without further changes.

3. The iOS build

The iOS project ships without the Push Notifications capability. Without it, the permission prompt still appears and the customer still agrees, and no notification is ever delivered. The build still archives, and the app only logs the failure, so nothing tells you except the release preflight (below).

Once GoogleService-Info.plist is in the project, the release preflight refuses a build without the capability:

[ios-push] iOS push cannot work: Firebase is configured but the app has no aps-environment entitlement

4. Your server

Push credentials are environment variables, not admin settings. From the same Firebase project, create a service account key (Project settings → Service accounts → Generate new private key), then set either the three values from it or the path to the file in your server's .env:

FCM_PROJECT_ID="your-project-id"
FCM_CLIENT_EMAIL="firebase-adminsdk-xxxxx@your-project-id.iam.gserviceaccount.com"
FCM_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n"

• FCM_PRIVATE_KEY is the whole key including its BEGIN/END lines. Its line breaks may be written as \n.
• Or set FCM_SERVICE_ACCOUNT_PATH to the downloaded JSON file. When it is set, it is used instead of the three values above. Give an absolute path.
• Restart the backend after changing .env.

FCM is switched on by a non-empty FCM_PROJECT_ID (or FCM_SERVICE_ACCOUNT_PATH). If one of the other two values is then missing, or a value looks like a placeholder (such as your-project-id), the server turns FCM off and logs why, for example Missing FCM_PRIVATE_KEY, or FCM_PROJECT_ID still holds the example value shipped in .env.example — FCM disabled. If you do not use push, leave FCM_PROJECT_ID empty. The details, and web push for browsers (VAPID_*, which the app does not use), are on Notifications.

Treat the service account key as a secret: it goes in the server's .env only, never in app_config.json or anywhere in the app.

Test it

The admin has a push tester under Admin → System → Communication Tools → Notification Service, on the Testing tab. Push sends a real notification titled Test Push Notification to your own account, or to the user ID you enter.

The Settings tab of the same screen names only one push provider, and names vapid (Web Push) whenever web push keys are set, even when FCM is working too. Use the Testing tab's FCM result instead.

What customers see

• One question, asked once. In a build with Firebase, when a customer signs in (with a password, with Google, or after a two-factor code), registers, or opens the app with a saved sign-in, and the phone does not yet allow the app's notifications, the app shows its own Stay informed sheet: "Get notified about deposits, withdrawals and account security events." On Android it offers Turn on notifications and Not now. On an iPhone it has a single Continue, because the iPhone's own prompt that follows has Don't Allow. The phone's prompt appears only after the customer continues. Whatever the answer, the app records it and never raises the subject by itself again on that install. If the phone already allows notifications, nothing is shown and the phone is registered.
• Without Firebase, a build asks for the phone's permission once per install, the first time it shows a notification that arrived while the app was open.
• Nothing else to turn on. When the app registers the phone, it sends your server an id for that account on that phone, and your server (Core 6.6.3 or later) switches push on for a customer who has never set a push preference. A customer who switched push off stays off. The id is worked out on the phone from a random secret made once per install and the account, so each account on a shared phone has its own, and it is not a hardware identifier. Builds before 5.4.0 sent no id, so their users received no push until they switched it on themselves; the updated build registers them at their next sign-in or start.
• Declined? Nothing is sent to that phone, and the app does not ask again. The customer can allow notifications for the app in the phone's settings; the app registers the phone the next time it opens signed in.
• Signing out removes the phone's push address and tells your server to stop sending to that phone for that account, so the next person to use the handset does not receive the previous account's notifications.

Which events are pushed

Not every notification becomes a push. Your server pushes the events the app can take the customer to — for example deposits, withdrawals, transfers and P2P trade updates. Other notices appear in the app's inbox only. The title of a push is cut at 65 characters and the text at 240.

What tapping a notification does

The app has no deep links. A push cannot open a specific trade, order or screen, and the links in your emails open your website, not the app.

After an update

google-services.json and GoogleService-Info.plist are yours and are not in any release you download. The Push Notifications capability lives in the Xcode project, so taking a new release's ios/Runner.xcodeproj removes it. After every update, copy both Firebase files across and add the capability again. See Updating your app.

What it deliberately does not do

• No push without your Firebase project. There is no shared or vendor project behind the app.
• No routing from a background tap. See the table above.
• No web push in the app. The VAPID_* keys serve browsers only.
• No analytics. Firebase is in the app for push delivery alone.

Declaring push in the stores' privacy forms is covered on Data safety and privacy.