GCM API key, registration ids to third party server

0
votes

How safe to provide GCM API key and GCM registration keys to third party servers (other than internal servers) ? Also, Do I need to create new API key for 3rd party server ? I need to understand how an untrusted server can misuse the GCM registration key.

2
androidfirebasegoogle-cloud-messagingfirebase-cloud-messaging
Possible duplicate of FCM Security: Prevent multiple senders from pushing notifications to all devices? - AL.

2 Answers

0
votes

Yes you can create API keys for every server, so that GCM will respond to only those server which were listed on your console

0
votes

If you provide the GCM API Key to a third party server, this server will be able to

  1. send notifications to the GCM registrations ids
  2. send notifications to topics
  3. subscribe / unsubscribe GCM registrations ids to topics

You can create a GCM API Key for every server,
so that you can invalidate it when your trust relationships ends.