Prepare your Firebase and mobile platforms

Step 1: Prepare Firebase and Google Cloud

Google Cloud Project Owner or  Firebase Project Owner

Push tokens belong to one Firebase project. A device's token works only with the project in your app's google-services.json (Android) or GoogleService-Info.plist (iOS), so the key you upload to the Portal must come from that same project. Switching projects later requires an app update and every device registers again. Use a company-owned project, ideally the one your app already uses.

Configuration overview

To prepare Firebase and Google Cloud, complete the following tasks:

  1. Confirm the project and its owner
  2. Check that your apps are registered in Firebase
  3. Turn on the Firebase Cloud Messaging API (V1)
  4. Create the Firebase service-account key
  5. If your organization blocks key creation (only if the Google Cloud console blocks you in task 4)
  6. Store and rotate keys safely

Confirm the project and its owner

  1. Sign in to the Google Cloud console and the Firebase console with your company account.
  2. Find the project your app uses.
    • For Android, open google-services.json and read project_info.project_id.
    • For iOS, open GoogleService-Info.plist and read PROJECT_ID.
  3. In the Google Cloud console, open the project picker and confirm the project appears under your organization's name. If it shows No organization or belongs to a personal account, ask your Google Cloud administrator to migrate it into your company organization before you continue.
  4. Grant the Owner role to a Google group, for example mobile-platform-admins@yourcompany.com, instead of to individuals. Keep at least two people in the group and remove personal accounts.

Tip
Firebase Cloud Messaging is free. You do not need to change billing for this setup.

Check that your apps are registered in Firebase

  1. In the Firebase console, go to Project settings > General > Your apps.
  2. For Android: Confirm an Android app exists whose package name matches your production app exactly, for example com.yourcompany.shop. A suffix such as .debug counts as a different app.
  3. For iOS: Confirm an Apple app exists whose bundle ID matches your app exactly.
  4. If an app is missing, select Add app, and then download the config file and give it to your developers.

Note: google-services.json and GoogleService-Info.plist are app configuration files. They aren't the service-account key the Portal asks for. Don't upload them to the Portal.

Turn on the Firebase Cloud Messaging API (V1)

  1. In the Firebase console, go to Project settings > Cloud Messaging.
  2. Under Firebase Cloud Messaging API (V1), confirm the status is Enabled.
  3. If it isn't, select the menu next to it, select Manage API in Google Cloud Console, and then select Enable. Alternatively, in the Google Cloud console, go to APIs & Services > Library, search for Firebase Cloud Messaging API, and select Enable.

If the V1 API is off, the Portal can't validate your key, and notifications don't send.

Create the Firebase service-account key

Use a dedicated service account with only the permissions push notifications need. Don't reuse a broad admin account.

  1. In the Google Cloud console, select your Firebase project and go to IAM & Admin > Service Accounts.
  2. Select Create service account.
  3. Enter a name and description. For example, enter bv-push-fcm-sender and "Sends Bazaarvoice review-request push notifications through FCM."
  4. Select Create and continue.
  5. Under Grant this service account access to project, add the Firebase Cloud Messaging API Admin and Firebase Viewer roles, and then select Continue > Done. 
  6. Open the new service account and select the Keys tab.
  7. Select Add key > Create new key > JSON > Create. Your browser downloads a .json file. Google lets you download the key only once.

Before you upload the file to the Portal, open it in a text editor and check that it contains "type": "service_account" and that it project_id matches the one in your app google-services.json. Don't paste its contents anywhere.

Note: As a quicker alternative, go to Project settings > Service accounts > Generate new private key in the Firebase console. This also produces a valid key, but it belongs to the Firebase Admin SDK service account, which has wide administrative access. For least privilege, use the dedicated account.

If your organization blocks key creation

If the Google Cloud console says that service-account key creation is disabled by an organization policy (iam.disableServiceAccountKeyCreation), ask your Google Cloud organization administrator to do one of the following:

  • Add an exception to the policy for this project only. The administrator can enforce the policy again afterward, and existing keys keep working.
  • Create the keys and give them to you through your company's secrets manager.

Your organization might also set a Service account key expiry duration (iam.serviceAccountKeyExpiryHours). If it does, your keys stop working on a fixed date and notifications stop sending. Add a calendar reminder to rotate the keys before then.

Store and rotate keys safely

Service-account keys and APNs keys are credentials. Treat them like passwords.

  • Store them in your company's secrets manager and limit access to the people who manage this integration.
  • Never email them, post them in chat, attach them to tickets, or commit them to source control.
  • Upload the original, unedited JSON file to the Portal. Don't reformat or convert it.
  • After you store the key in your secrets manager, delete the downloaded copy from your computer.
  • Record each key's ID and creation date so you know when to rotate it.

To rotate a key, create a new key for the same service account, edit the sender profile and upload the new file, send a test notification, and then delete the old key in the Google Cloud console. If a key leaks, delete it in the Google Cloud console right away, create a new one, update the Portal, and notify Bazaarvoice Support.

Step 2: Prepare for Android

Google Play Console Administrator and  Google Cloud Project Owner

Bazaarvoice uses Google Play Integrity to confirm that each registering device runs your genuine app from Google Play. For this, you need a second service-account key from the Google Cloud project that's linked to your app in Google Play Console.

  1. In Google Play Console, open your app and go to Test and release > App integrity. In some versions, the path is Release > App integrity.
  2. Under Play Integrity API, select Link a Cloud project and choose your company project. Use the same project as your Firebase project if possible.
  3. Note the project number (Google Cloud console → project dashboard) and give it to your developers. This is required in Android integration needs it (B3, A3).
  4. In the Google Cloud console for that project, go to APIs & Services > Library, search for Google Play Integrity API, and confirm it's Enabled.
  5. In the same project, create a second service account, for example bv-push-play-integrity. Grant the roles that Google's Play Integrity documentation lists for decoding integrity verdicts on a server. At the time of writing, these are Service Account User and Service Usage Consumer.
  6. For that service account, select Keys > Add key > Create new key > JSON.
  7. Copy your Android package name from Google Play Console. You enter it in the Portal.

Use a separate key for Play Integrity so you can rotate or revoke it without affecting the Firebase key.

Note: Linking happens per app. If you have more than one Android app, for example, separate brands, link the Cloud project for each one in Google Play Console.

Step 3: Prepare for iOS

Apple Developer Account Administrator  

Firebase delivers notifications to iPhones through Apple Push Notification service (APNs), so Firebase needs your APNs key. Use your company's Apple Developer organization membership, not a personal one.

  1. In Apple Developer, go to Certificates, Identifiers & Profiles > Keys and select +.
  2. Enter a key name, turn on Apple Push Notifications service (APNs), and then select Continue > Register.
  3. Select Configure next to APNs and choose "Sandbox & Production," so one key works for Xcode and App Store builds.
  4. Download the .p8 file and note the Key ID. Apple lets you download the file only once. Upload it for both development and production. Builds run from Xcode use development APNs. 
  5. Note your 10-character Team ID under Membership details.
  6. In the Firebase console, go to Project settings > Cloud Messaging > Apple app configuration.
  7. For your iOS app, upload the .p8 file under APNs Authentication Key and enter the Key ID and Team ID.
  8. Note your app's bundle ID. In Xcode, it's on your app target's Signing & Capabilities tab.

You enter the bundle ID and Team ID in the Portal. You don't upload the .p8 file to the Portal.

Provide feedback button