Add support for the new FCM registration ID. by leojaygoogle · Pull Request #16133 · firebase/firebase-ios-sdk

leojaygoogle · 2026-04-29T00:20:38Z

This is to integrate with the new V1 Registration API go/android-gmi-v1-registration-api

It defaults to NO. When enabled, FCM will not generate an FCM registration token, but an FID instead.

…anagement system. Currently, the FCM SDK calls the `https://fcmtoken.googleapis.com/register` backend to register an FCM V4 registration token. Going forward, we'd like to deprecate this token and use FID instead.

Once `unregister()` is called successfully and auto-init is disabled, Sending a push notification to the FID will result in an `UNREGISTERED` error.

This method is similar to `messaging(_:didReceiveRegistrationToken:)`, but will be called instead when `isInstallationIdEnabled` is `YES`.

gemini-code-assist · 2026-04-29T00:20:42Z

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

…hods

Doris-Ge

Does our existing implementation listen for a FID change via a listener and re-register on a change? If not, we may want to add that.

I'm still reviewing the PR, but I'd like to give some early feedback in case you want to address or discuss it. Since I'm not familiar with Swift, I need more time for a full review. Sorry about that!

…okenFetchOperation. It's not used by other classes.

…didUnregister is called only when the deletion succeeded.

Doris-Ge · 2026-05-11T06:39:44Z

+      @"apns_token" : apnsTokenString,
+      @"app_version" : appVersion,
+      @"apns_environment" : apnsEnvironment
+    },


I've proposed adding the bundle_id field to the backend API in cl/913512427. Can we start passing it here?It should be fine, even in the worst-case scenario where the API Council disapproves the CL.

Discussed offline. we will add that later.

Doris-Ge · 2026-05-12T00:57:58Z

+                            @"No Sender ID is available to register");
+    return;
+  }
+  [self setupInstallationIDObserver];


Shall we clear the observer during unregister()? If an app disables the auto init and calls unregister() after calling register(), not clearing the observer may automatically register the app with backend on FID changes, which may be unexpected for developers.

Also, it seems the observer is only set up in the register() method. Calling register() is optional for apps that enable auto-init. We should make sure that those apps can also re-register on FID changes.

Consider setting up this observer regardlessly but only re-register when the app is registered as Eldhose did for Android: https://screenshot.googleplex.com/xmAGrSTKbyRMpSm.

It tests that when `FirebaseMessaging.isInstallationIdEnabled` is `YES`, calling `register()` triggers a V1 registration API HTTP request. After receiving the registered FID, the message delegate's `didReceiveRegistration` should be called.

…register`. So that it doesn't depend on the `register` being called.

wiz-9635d3485b · 2026-05-13T16:00:17Z

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	3
Software Management Findings	-

Total	3

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.

…IdEnabled`

Doris-Ge · 2026-05-14T01:21:20Z

+  }
+
+  NSString *urlString = [NSString
+      stringWithFormat:@"https://fcmregistrations.googleapis.com/v1/projects/%@/registrations",


Just curious: after this change is backported to google3, will we point our 1P SDKs to use the staging API or not?

AFAIK, 1p and 3p use the same SDK. They use the staging backend server for some traffic.

Thanks! To check my understanding, they all use prod backend for registration traffic but 1P may use the staging backend for some send traffic, is that correct?

We decided to make it a required input.

Doris-Ge · 2026-06-06T00:06:25Z

+        return;
+      }
+      // Registration will only be triggered if FID is changed
+      if (![identifier isEqualToString:self.lastKnownFID]) {


Shall we also check if the app instance is registered or not? I think we should avoid creating a registration if the app disables auto-init and never calls register().

Doris-Ge · 2026-06-06T00:54:52Z

  // setup FIRMessaging objects
  [self setupRmqManager];
  [self setupSyncMessageManager];
+  [self setupInstallationIDObserver];


Is it intentional that we set up this observer no matter whether the installation id flag is enabled? It might be better to only set up this observer when installation id mode is enabled to avoid changing the existing behavior of token rotation.

Doris-Ge · 2026-06-06T02:19:11Z

                                          scope:kFIRMessagingDefaultTokenScope];
  NSString *cachedToken = cachedTokenInfo.token;

  if (cachedToken) {


Ideally, we should avoid returning a different FID from FIS API.
When the cachedToken is a FID, it would be nice if we can get the FID from FIS and check if cachedToken is equal to the FID. If it's not, then we should use the new FID to register.
Could we use isFreshWithIID to see if the token needs refresh and refresh it if yes?

Doris-Ge · 2026-06-08T18:56:59Z

+              }];
+}
+
+- (void)register {


This method should always trigger the didReceiveRegistration callback to deliver the FID no matter whether there's a cached FID or not: https://screenshot.googleplex.com/6aheYbeDbYEJnAF. This is designed to let developers retrieve the FID even when the app instance is already registered.

Consider adding a unit test for this scenario.

Doris-Ge · 2026-06-08T19:15:22Z

+  if (self.isInstallationIdEnabled) {
+    NSString *normalizeTopic = [[self class] normalizeTopic:topic];
+    if (normalizeTopic.length) {
+      [self.pubsub subscribeToTopic:normalizeTopic handler:completion];


We should also make sure to register the app instance with FCM if it hasn't been registered before calling subscribeToTopic like what we do below at line 822. This is because the subscription will fail on the backend if there's no FCM registration found for this app instance.

Consider adding a unit test for this scenario.

ncooke3 · 2026-06-09T17:18:15Z

@leojaygoogle @Doris-Ge , can messaging CI please be fixed?

ncooke3 · 2026-06-09T17:20:52Z

/gemini review

gemini-code-assist

Code Review

This pull request introduces support for the new FCM registration API via Firebase Installation ID (FID), allowing apps to register with FCM using their Installation ID instead of generating standard FCM registration tokens. Key changes include the addition of register and unregister methods, FID rotation handling, and new operation classes FIRMessagingFIDRegisterOperation and FIRMessagingFIDUnregisterOperation. Feedback on these changes highlights several critical issues, including potential crashes from accessing instance variables directly on a nil self after strongifying, resource leaks from creating a new NSURLSession for every request, and a potential crash if the server returns a non-string name in the JSON response. Additionally, a logic error was noted where standard token retrieval is incorrectly triggered during FID rotation when isInstallationIdEnabled is active.

gemini-code-assist · 2026-06-09T17:24:02Z

+          FIRMessaging_STRONGIFY(self);
+          // Retry on network error or backend server 5xx error.
+          if ((error || isServerError(response)) && self->_retryCount < kMaxRetries) {


If self is nil (e.g., if the operation is cancelled or released and weakSelf becomes nil), accessing self->_retryCount directly will cause a segmentation fault and crash the app. Always check if self is non-nil after FIRMessaging_STRONGIFY(self) before accessing instance variables directly.

FIRMessaging_STRONGIFY(self); if (!self) { return; } // Retry on network error or backend server 5xx error. if ((error || isServerError(response)) && self->_retryCount < kMaxRetries) {

gemini-code-assist · 2026-06-09T17:24:02Z

+                  FIRMessaging_STRONGIFY(self);
+                  self->_retryCount++;
+                  [self makeRegistrationRequestWithAuthToken:authToken];


If self is nil when the dispatch_after block executes, accessing self->_retryCount++ directly will cause a segmentation fault and crash the app. Always check if self is non-nil after FIRMessaging_STRONGIFY(self) before accessing instance variables directly.

FIRMessaging_STRONGIFY(self); if (!self) { return; } self->_retryCount++; [self makeRegistrationRequestWithAuthToken:authToken];

gemini-code-assist · 2026-06-09T17:24:02Z

+          FIRMessaging_STRONGIFY(self);
+
+          // Retry on network error or backend server 5xx error.
+          if ((error || isServerError(response)) && self->_retryCount < kMaxRetries) {


If self is nil (e.g., if the operation is cancelled or released and weakSelf becomes nil), accessing self->_retryCount directly will cause a segmentation fault and crash the app. Always check if self is non-nil after FIRMessaging_STRONGIFY(self) before accessing instance variables directly.

FIRMessaging_STRONGIFY(self); if (!self) { return; } // Retry on network error or backend server 5xx error. if ((error || isServerError(response)) && self->_retryCount < kMaxRetries) {

gemini-code-assist · 2026-06-09T17:24:02Z

+                  FIRMessaging_STRONGIFY(self);
+                  self->_retryCount++;
+                  [self makeUnregistrationRequestWithAuthToken:authToken];


If self is nil when the dispatch_after block executes, accessing self->_retryCount++ directly will cause a segmentation fault and crash the app. Always check if self is non-nil after FIRMessaging_STRONGIFY(self) before accessing instance variables directly.

FIRMessaging_STRONGIFY(self); if (!self) { return; } self->_retryCount++; [self makeUnregistrationRequestWithAuthToken:authToken];

gemini-code-assist · 2026-06-09T17:24:02Z

+        [self retrieveFCMTokenForSenderID:self.tokenManager.fcmSenderID
+                               completion:^(NSString *_Nullable FCMToken, NSError *_Nullable error){
+                               }];


If isInstallationIdEnabled is YES, calling retrieveFCMTokenForSenderID will fail or be blocked (as it is a token-related operation). Instead, we should call tokenWithAuthorizedEntity:scope:options:handler: on self.tokenManager directly to perform the internal FID registration when the FID rotates.

if (self.isInstallationIdEnabled) { [self.tokenManager tokenWithAuthorizedEntity:self.tokenManager.fcmSenderID scope:kFIRMessagingDefaultTokenScope options:self.APNSToken ? @{kFIRMessagingTokenOptionsAPNSKey : self.APNSToken} : nil handler:^(NSString * _Nullable FCMToken, NSError * _Nullable error) { }]; } else { [self retrieveFCMTokenForSenderID:self.tokenManager.fcmSenderID completion:^(NSString *_Nullable FCMToken, NSError *_Nullable error){ }]; }

gemini-code-assist · 2026-06-09T17:24:02Z

+  NSURLSessionConfiguration *config = NSURLSessionConfiguration.ephemeralSessionConfiguration;
+  NSURLSession *session = [NSURLSession sessionWithConfiguration:config];


Creating a new NSURLSession for every single request is highly inefficient and leaks resources (threads/memory) unless explicitly invalidated. Reusing a shared session avoids TLS handshake overhead on every registration request and improves performance.

static NSURLSession *session; static dispatch_once_t onceToken; dispatch_once(&onceToken, ^{ NSURLSessionConfiguration *config = NSURLSessionConfiguration.ephemeralSessionConfiguration; session = [NSURLSession sessionWithConfiguration:config]; });

gemini-code-assist · 2026-06-09T17:24:02Z

+  NSURLSessionConfiguration *config = NSURLSessionConfiguration.ephemeralSessionConfiguration;
+  NSURLSession *session = [NSURLSession sessionWithConfiguration:config];


Creating a new NSURLSession for every single request is highly inefficient and leaks resources (threads/memory) unless explicitly invalidated. Reusing a shared session avoids TLS handshake overhead on every unregistration request and improves performance.

Suggested change

NSURLSessionConfiguration *config = NSURLSessionConfiguration.ephemeralSessionConfiguration;

NSURLSession *session = [NSURLSession sessionWithConfiguration:config];

static NSURLSession *session;

static dispatch_once_t onceToken;

dispatch_once(&onceToken, ^{

NSURLSessionConfiguration *config = NSURLSessionConfiguration.ephemeralSessionConfiguration;

session = [NSURLSession sessionWithConfiguration:config];

});

gemini-code-assist · 2026-06-09T17:24:02Z

+  NSString *name = responseDict[@"name"];
+  NSString *fid = nil;
+  if (name.length) {


If the server returns an unexpected JSON response where name is not a string (e.g., a dictionary or number), calling name.length directly will cause a crash due to unrecognized selector. Always type-check JSON values using isKindOfClass:[NSString class] before calling string methods.

NSString *name = responseDict[@

leojaygoogle added 8 commits April 17, 2026 15:29

Introduce new Info.plist key FirebaseMessagingInstallationIdEnabled.

12a6ad8

It defaults to NO. When enabled, FCM will not generate an FCM registration token, but an FID instead.

Add retry logic on network error and backend 5xx error.

b442d42

Implement the FCM FID unregistration operation.

fe49a75

Once `unregister()` is called successfully and auto-init is disabled, Sending a push notification to the FID will result in an `UNREGISTERED` error.

Add didReceiveRegistration delegate method.

f1294be

This method is similar to `messaging(_:didReceiveRegistrationToken:)`, but will be called instead when `isInstallationIdEnabled` is `YES`.

Update the sample app to handle the new registration ID.

8c0ba25

Update CHANGELOG

b471f82

Style update.

4b72a42

danger-firebase-ios Bot added api: messaging public-api-change labels Apr 29, 2026

Doris-Ge reviewed Apr 29, 2026

View reviewed changes

Comment thread FirebaseMessaging/Sources/Public/FirebaseMessaging/FIRMessaging.h Outdated

leojaygoogle added 3 commits April 29, 2026 11:33

Use the internal FirebaseInstallations header file.

c28628b

Rename registrationId to installationId in messaging delegate met…

e7aeac8

…hods

Update copyright header to include LLC

836b697

Doris-Ge reviewed Apr 29, 2026

View reviewed changes

Fix various compile warnings.

dff8587

Doris-Ge reviewed Apr 30, 2026

View reviewed changes

Comment thread FirebaseMessaging/Sources/Public/FirebaseMessaging/FIRMessaging.h

Comment thread FirebaseMessaging/Sources/Public/FirebaseMessaging/FIRMessaging.h

Comment thread FirebaseMessaging/Sources/FIRMessaging.m Outdated

Comment thread FirebaseMessaging/Sources/FIRMessaging.m

leojaygoogle added 7 commits April 30, 2026 17:09

Add an FIRMessagingErrorCode to indicate installation related errors.

503c5b6

Move heartbeatLogger from FIRMessagingTokenOperation to FIRMessagingT…

c12d985

…okenFetchOperation. It's not used by other classes.

Fix style warnings and address review comments.

1d4c3f8

Mark authorizedEntity as nullable.

e984467

Add FIRMessagingInstallationIdUnregisteredNotification and make sure …

125dac3

…didUnregister is called only when the deletion succeeded.

Monitor FID change events and register the new FID when it happens.

d95a204

Delete unused methods.

f7cea1d

Doris-Ge reviewed May 11, 2026

View reviewed changes

Doris-Ge reviewed May 12, 2026

View reviewed changes

leojaygoogle added 3 commits May 13, 2026 01:40

Add testUnregisterNotifiesDelegateWhenInstallationIdEnabled

26c94d2

Move installationIDObserver setup to the start method, instead of `…

6093f94

…register`. So that it doesn't depend on the `register` being called.

Fix test ordering failure in FIRMessagingTokenInfoTest.

e7433b8

Add test `testAppStartNotifiesDelegateWhenBothAutoInitAndInstallation…

77ad7f5

…IdEnabled`

leojaygoogle marked this pull request as ready for review May 13, 2026 17:29

leojaygoogle requested a review from a team as a code owner May 13, 2026 17:29

Doris-Ge approved these changes May 14, 2026

View reviewed changes

leojaygoogle added 3 commits June 3, 2026 11:18

Add bundle_id to FID registration payload.

fd64ad9

We decided to make it a required input.

Fix unit test failures.

1c52ccb

Implement FID topic subscription and unsubscription

befa3a4

Doris-Ge reviewed Jun 8, 2026

View reviewed changes

gemini-code-assist Bot reviewed Jun 9, 2026

View reviewed changes

		NSURLSessionConfiguration *config = NSURLSessionConfiguration.ephemeralSessionConfiguration;
		NSURLSession *session = [NSURLSession sessionWithConfiguration:config];

Conversation

leojaygoogle commented Apr 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist Bot commented Apr 29, 2026

Uh oh!

Uh oh!

Doris-Ge left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Doris-Ge May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wiz-9635d3485b Bot commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Wiz Scan Summary

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ncooke3 commented Jun 9, 2026

Uh oh!

ncooke3 commented Jun 9, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Jun 9, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jun 9, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jun 9, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jun 9, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jun 9, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jun 9, 2026

Choose a reason for hiding this comment

leojaygoogle commented Apr 29, 2026 •

edited

Loading

Doris-Ge May 12, 2026 •

edited

Loading

wiz-9635d3485b Bot commented May 13, 2026 •

edited

Loading