Mobile setup (do this first)

ReachBell doesn't send mobile push from its own credentials — it sends through yours. Android goes out through your Firebase project; iOS goes out through your Apple Push Notification service key. So before any device can receive a notification, you upload those credentials to your ReachBell project once.

Do this first. The React Native, Flutter, iOS, and Android SDK guides all assume the project already has its credentials in place — a device will register fine without them, but the actual push send will fail with a "credentials missing" error until you complete this page.

Credentials are set per project. If you run separate projects for staging and production (recommended — see Teams & projects), upload credentials to each. Uploading and rotating credentials requires the Owner or Admin role.

Android — FCM service-account JSON

ReachBell sends Android push through the Firebase Cloud Messaging HTTP v1 API, which authenticates with a Google service account. You give ReachBell that service account's JSON key.

1. Get the service-account JSON from Firebase.

In the Firebase console, open the project your app uses.
Project settings ▸ Service accounts ▸ Generate new private key.
Confirm — a JSON file downloads. Treat it like a password; it grants send access to your project.

2. Upload it to ReachBell.

In the dashboard, open your project's settings and paste the JSON into the Android (FCM) credentials field. Via the API it's:

PATCH /projects/:id/fcm-config

{
  "serviceAccountJson": "{ \"type\": \"service_account\", \"project_id\": \"…\", \"client_email\": \"…\", \"private_key\": \"-----BEGIN PRIVATE KEY-----\\n…\" }"
}

ReachBell parses the JSON and checks it has the fields it needs — client_email, private_key, and project_id — rejecting the upload if any are missing or the JSON is malformed. On send, it uses project_id from the key to call https://fcm.googleapis.com/v1/projects/<project_id>/messages:send.

The service-account JSON is separate from the google-services.json you add to your app. That file lets the app fetch an FCM token; this one lets ReachBell's server send to it. You need both, in different places — see the Android SDK for the client side.

iOS — APNs `.p8` auth key

ReachBell sends iOS push using token-based APNs authentication: a single .p8 signing key plus three identifiers. This is the modern approach — one key works across all your apps and never expires, unlike a per-app .p12 certificate.

1. Create the key in the Apple Developer portal.

Go to Certificates, Identifiers & Profiles ▸ Keys.
+ to register a key, give it a name, and tick Apple Push Notifications service (APNs).
Register, then Download the .p8 file. Apple lets you download it once — save it somewhere safe.
Note the Key ID shown next to the key, and your Team ID (top-right of the portal, under your account).

2. Upload it to ReachBell.

Paste the values into your project's iOS (APNs) credentials in the dashboard, or:

PATCH /projects/:id/apns-config

{
  "keyId":    "ABC123DEF4",
  "teamId":   "DEF456GHI7",
  "bundleId": "com.example.app",
  "p8Key":    "-----BEGIN PRIVATE KEY-----\n…\n-----END PRIVATE KEY-----",
  "sandbox":  false
}

Field	Where it comes from
`keyId`	The Key ID shown next to the key in the Apple portal.
`teamId`	Your Apple Team ID.
`bundleId`	Your app's bundle identifier, e.g. `com.example.app`. Used as the APNs topic.
`p8Key`	The full PEM contents of the downloaded `.p8` file.
`sandbox`	`false` for production; `true` to route through Apple's sandbox.

Open the .p8 in a text editor and paste everything, including the -----BEGIN PRIVATE KEY----- / -----END PRIVATE KEY----- lines — ReachBell checks it looks like a PEM key and requires all four core fields before saving.

Sandbox vs production

Apple runs two APNs environments, and a token is only valid on the one that issued it. The sandbox flag picks which one ReachBell sends to:

sandbox: true → api.sandbox.push.apple.com. Use this for Xcode debug builds and TestFlight, whose device tokens are sandbox tokens.
sandbox: false (default) → production APNs. Use this for App Store builds.

If your test pushes silently never arrive, this flag is the usual culprit: a debug-build token sent through production (or vice versa) is rejected by Apple as a bad device token. Match the flag to how the build was signed.

Security: write-only credentials

Everything you upload here is encrypted at rest and never handed back. A GET on the project doesn't return the service-account JSON or the .p8 — only whether a credential is present (hasServiceAccount, hasP8Key) plus the non-secret identifiers like keyId, teamId, and bundleId. To change a key, upload a new one; you can't read the old one back out.

Verify it works

Once credentials are in place:

Register a real device with the matching platform SDK (Android / iOS / React Native / Flutter). Push doesn't reach simulators — use a physical device.
Send a test push to that subscriber from the dashboard.
If it fails with a "credentials missing" or "misconfigured" error, re-check this page; if iOS reports a bad device token, re-check the sandbox flag.