sender id does not match regisration token

[niocncn]

I have an error

http error status: 403; reason: sender id does not match regisration token; code: mismatched-credential

everything made as said in documentation, i can send push notification from firebase web interface, but not from server.

my code is

func PushHandler(message <- chan Helpers.PushChannelMessage)  {
    log.Println("PushHandler INIT")
    ctx := context.Background()
    opt := option.WithCredentialsFile("XXXX.json")
    config := &firebase.Config{ProjectID: "XXXX"}
    app, err := firebase.NewApp(ctx, config, opt)
    if err != nil {
        log.Println(err)
        return
    }
    client, err := app.Messaging(ctx)
    for {
        c:= <- message
        fmt.Println("PushChan",c)
        if err == nil {
            message := &messaging.Message{
                Data: map[string]string{
                    "score": "850",
                    "time":  "2:45",
                },
                Token: c.Token,
            }
            response, err := client.SendDryRun(ctx, message)
            if err != nil {
                log.Println(err)
                continue
            }
            fmt.Println("Successfully sent message:", response)
        }else{
            log.Println("error pushchan ->>", err)
        }
    }
}

[google-oss-bot]

Hey there! I couldn't figure out what this issue is about, so I've labeled it for a human to triage. Hang tight.

[google-oss-bot]

Hmmm this issue does not seem to follow the issue template. Make sure you provide all the required information.

[chemidy]

You can have more informations for error code here

[niocncn]

i made all steps as said in documentation, and i can send notification from console, these means device sdk works good, but server library throw exception

[hiranya911]

Make sure your service account JSON file comes from the same project. You don't have to specify a ProjectID in Config when using service accounts. Just let the SDK pick the project ID given in the credentials file.

[niocncn]

I'm completely sure service account JSON comes from the same project. I have just one project.

[niocncn]

I tried to send from localhost and from server, no difference.

[martinflorek]

We have exactly the same problem. Interesting thing is that registering a FCM token into topic works, but sending a notification fails with the same 403 error response.

The only difference is that we are sending notification to a topic instead of to a token. And we are using the Firebase admin GO SDK on Google App Engine standard environment.

[niocncn]

May be problem in users rules in "iam administration" panel? But i tried to add new, and to change rules for existing users, and it didn't make sence.

[martinflorek]

We finally found the issue. Our Google Cloud project did not have enabled the Firebase Cloud Messaging API, just the Google Cloud Messaging.

After that initializing the GO Admin SDK without any credentials we are able to send push notifications. Also creating the credentials key JSON file in the Google Cloud console instead of in the Firebase console works.

[niocncn]

yes, thanks! That fixes my problem too.

link: https://console.cloud.google.com/apis/api/fcm.googleapis.com/overview

[hiranya911]

Great job figuring this out @martinflorek. This is the full response sent by the FCM in this case:

{
  "error": {
    "code": 403,
    "message": "Firebase Cloud Messaging API has not been used in project xxx-yyy-zzz before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/fcm.googleapis.com/overview?project=xxx-yyy-zzz then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.",
    "status": "PERMISSION_DENIED",
    "details": [
      {
        "@type": "type.googleapis.com/google.rpc.Help",
        "links": [
          {
            "description": "Google developers console API activation",
            "url": "https://console.developers.google.com/apis/api/fcm.googleapis.com/overview?project=xxx-yyy-zzz"
          }
        ]
      }
    ]
  }
}

The SDK ignores the message and only looks at the error code, which results in the confusing error. We can probably improve this behavior of the SDK. I'll reopen the issue to keep track.

[hiranya911]

This behavior seems to be specific to the Go SDK. Node, Java and Python do include the message field in the exceptions thrown.

[hiranya911]

Error messages have been updated to include full details sent by the backend server.

[nilsmagnus]

I had the same problem. I was running the server on google-cloud-run in one project, and the firebase-project was another account. To solve it I had to manually fill in all the firebase.Config object like this:

opt := option.WithCredentialsJSON([]byte(`
    {
  "type": "service_account",
  "project_id": "XXX",
  "private_key_id": "XXX",
  "private_key": "-----BEGIN PRIVATE KEY----- .... ",
  "client_email": "XXX",
  "client_id": "XXX",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "XXX"
}`))

authOverrides := make(map[string]any, 0)
config := firebase.Config{
        ServiceAccountID: "XXX",
        StorageBucket:    "your-appstore-bucket",
        ProjectID:        "XXX",
        AuthOverride:     &authOverrides,
    }
app, err := firebase.NewApp(context.Background(), &config, opt)