Skip to content

Firebase Cloud Messaging API Key

Service Name: Firebase Cloud Messaging (FCM)

Service Description: Firebase Cloud Messaging is a cross-platform messaging solution that lets you reliably send notifications and messages to iOS, Android, and web applications. It allows developers to send push notifications to users' devices, even when the app is in the background or not running.

Service Address: https://firebase.google.com/docs/cloud-messaging

Validation Type: API Auth

IP Allow list: IP restrictions can be configured through Firebase project settings and Google Cloud Platform's network security configurations.

Secret Access Scope: Grants the ability to send push notifications to devices registered with your Firebase project. Can be used to send messages to individual devices, groups of devices, or topics.

Secret Revokement URL: https://console.firebase.google.com/project/_/settings/cloudmessaging

Secret Example: AIzaSyDQe9-sTRrOWV_dMSygCgZQwG9l7sJ-Xpk

Suspicious Activity Investigation Instructions:

  • Review Firebase Console logs for unusual message sending patterns or volume spikes
  • Check Firebase Analytics for unexpected notification delivery metrics
  • Monitor for notifications being sent from unauthorized IP addresses or locations
  • Examine the Firebase project audit logs for unauthorized configuration changes
  • Verify if there are any unexpected changes to notification templates or content

Mitigation Instructions:

  • Navigate to the Firebase Console and select your project
  • Go to Project Settings > Cloud Messaging
  • Rotate the compromised Server Key by generating a new one
  • Delete the compromised API key
  • Update all legitimate applications and services with the new API key
  • Review and update Firebase Security Rules to restrict access
  • Consider implementing IP allowlisting for your Firebase project
  • Enable Firebase App Check to verify that requests are coming from your app
  • Update any CI/CD pipelines or deployment scripts that might contain the old key