APNs Authentication Key's Not working for GCM iOS app configuration

[Andreas409]

[REQUIRED] Step 2: Describe your environment

• Xcode version: Version 11.0 (11A420a)
• Firebase SDK version:
• Firebase Component: Messaging
• Component version:
  Firebase/Core (6.10.0):
  • Firebase/CoreOnly
  • FirebaseAnalytics (= 6.1.3)

• Firebase/CoreOnly (6.10.0):
  • FirebaseCore (= 6.3.1)
• Firebase/Messaging (6.10.0):
  • Firebase/CoreOnly
  • FirebaseMessaging (~> 4.1.6)
• FirebaseAnalytics (6.1.3):
  • FirebaseCore (~> 6.3)
  • FirebaseInstanceID (~> 4.2)

[REQUIRED] Step 3: Describe the problem

Any newly added app on a Firebase project, would only work if we used Prod and Sandbox APNs certificates in the iOS app configuration for Cloud Messaging.

Our APNs Authentication Key (even though it is valid and works on multiple other projects), would not work.

Steps to reproduce:

We had to migrate App A, B, C from Project 1 to Project 2. App A, B & C on project 1 all were using the APNs Authentication Key with success (were linked a few weeks back).

Yesterday we removed App A,B,C from Project 1 and added them on Project 2 and used the APNs Authentication Key for the Cloud Messaging.

We kept on getting:

{ 
"@type": "type.googleapis.com/google.firebase.fcm.v1.ApnsError", 
"statusCode": 403, 
"reason": "InvalidProviderToken"
 }

In pure desperation and frustration after trying a million things, we created a brand new project (Xcode & Firebase) and used that same APNs Key. Same error. I then moved App A back onto Project 1 (APNs Key was automatically linked when the app ID was added) and boom notifications worked again.

As a last resort we tried with manually created certificates (Old way), and suddenly everything worked. And this has been verified on App A, B & C on Project 2 as well as the Test Project.

With all of the above we sent push notifications as follows:

We have for App A, B & C iOS and Android equivalents. Android was never affected by any of this. Throughout all of this we tried to send push notifications to specific Device Id's and topics using the Firebase Admin SDK code & Bearer tokens generated from the Private Service Account Key. We also tried through the Firebase Cloud Messaging console.

The Full error response is what we got for the device Id targeted pushes:

{
  "error": {
    "code": 401,
    "message": "Auth error from APNS or Web Push Service",
    "status": "UNAUTHENTICATED",
    "details": [
      {
        "@type": "type.googleapis.com/google.firebase.fcm.v1.FcmError",
        "errorCode": "THIRD_PARTY_AUTH_ERROR"
      },
      {
        "@type": "type.googleapis.com/google.firebase.fcm.v1.ApnsError",
        "statusCode": 403,
        "reason": "InvalidProviderToken"
      }
    ]
  }
}

[Andreas409]

@chliangGoogle

[leojaygoogle-zz]

Please make sure the following settings are correct:

1. Team id
2. Key id
3. Bundle id
4. APNS auth key.

Those 4 settings are used to generate JWT provider tokens. If any of them is not correct, you will get InvalidProviderToken errors.

[Andreas409]

Yea these were triple checked and confirmed. We even made a new project with new app ID and entered and uploaded. Unless there is some limit we reached for the APNS auth key. We currently already have 9 apps using that Auth Key.

[leojaygoogle-zz]

Can you send notifications directly to APNs?

Here is the script I use to send notifications to APNs for your reference. Please set DEVICE_ID, AUTH_KEY_ID, TEAM_ID, BUNDLE_ID, and make sure that the auth key file exists before running it.

#!/bin/bash

DEVICE_ID=

KEY_FILE="./key_file.p8"
AUTH_KEY_ID=
TEAM_ID=
BUNDLE_ID=
ENDPOINT=https://api.push.apple.com

read -r -d '' payload <<-'EOF'
{
   "aps": {
      "badge": 2,
      "alert": {
         "title": "Test message",
         "sound": "default",
         "body": "TIME"
      }
   }
}
EOF

# --------------------------------------------------------------------------

base64() {
   openssl base64 -e -A | tr -- '+/' '-_' | tr -d =
}

sign() {
   printf "$1"| openssl dgst -binary -sha256 -sign "$KEY_FILE" | base64
}

time=$(date +%s)
header=$(printf '{ "alg": "ES256", "kid": "%s" }' "$AUTH_KEY_ID" | base64)
claims=$(printf '{ "iss": "%s", "iat": %d }' "$TEAM_ID" "$time" | base64)
jwt="$header.$claims.$(sign $header.$claims)"

time_str=$(date -Iseconds)
curl --verbose \
   --header "content-type: application/json" \
   --header "authorization: bearer $jwt" \
   --header "apns-topic: $BUNDLE_ID" \
   --data "${payload/TIME/$time_str}" \
   $ENDPOINT/3/device/$DEVICE_ID

[charlotteliang]

Can you also check when you switch to project 2, the first time you open the app, can you get the debugLog there? I'm trying to see if a new token request is triggered (or you can see if your app's FCMToken has changed)

[Andreas409]

Hi. Sorry for the delayed response, been swamped at work.

Just tried the above in Test Project 2 (can't mess with our live project for now).

Was unable to send Pushes with the script you provided. Was not sure if DEVICE_ID should be the firebase token or the apple token received in AppDelegate. So I tried both, and both came back with {"reason":"InvalidProviderToken"}* Closing connection 0.

See full trace below:

*   Trying 17.188.150.159...
* TCP_NODELAY set
* Connected to api.push.apple.com (17.188.150.159) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/cert.pem
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Request CERT (13):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-CHACHA20-POLY1305
* ALPN, server accepted to use h2
* Server certificate:
*  subject: CN=api.push.apple.com; OU=management:idms.group.533599; O=Apple Inc.; ST=California; C=US
*  start date: Mar 14 17:50:10 2019 GMT
*  expire date: Apr 12 17:50:10 2021 GMT
*  subjectAltName: host "api.push.apple.com" matched cert's "api.push.apple.com"
*  issuer: CN=Apple IST CA 2 - G1; OU=Certification Authority; O=Apple Inc.; C=US
*  SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x7fa317008c00)
> POST /3/device/b19adb87c985cfca7012d8e16dc22b1e50b41d53575d83801a0dc9b2d6f46884 HTTP/2
> Host: api.push.apple.com
> User-Agent: curl/7.64.1
> Accept: */*
> content-type: application/json
> authorization: bearer eyAiYWxnIjogIkVTMjU2IiwgImtpZCI6ICI5Vzc1Vjk5SDM3IiB9.eyAiaXNzIjogIjcyTDM1TFhWM0oiLCAiaWF0IjogMTU3MTM3NTA0NiB9.MEUCIQCbTHD-_kvWb_b-Auwk3jdO9jUz2A49rIuJEjLnPbd0BwIgZsEeKqOT_UWuFELzXt3iGiGPMt8QlWMmlrq8kxD6J64
> apns-topic: io.flatcircle.PushTest
> Content-Length: 146
> 
* Connection state changed (MAX_CONCURRENT_STREAMS == 1)!
* We are completely uploaded and fine
< HTTP/2 403 
< apns-id: 2FBC7242-2014-855D-CA8A-D36EA289D940
< 
* Connection #0 to host api.push.apple.com left intact
{"reason":"InvalidProviderToken"}* Closing connection 0

==========

Regarding debug log on first run:

My current Firebase token is fTjG2q_0zRI:APA91bFJXFch....WowrkRPsCHwYbQ8QxYGSeyk

Clean install on first run gives me a new token of: eoEzZtLWw74:APA9...huLWm-iE3z4Zd1H

So token did change on a fresh install. Token came in as I allowed push notifications.

Tried sending via console & your script to the new tokens and still the same response as above: InvalidProviderToken

[leojaygoogle-zz]

The script talks to APNs directly without going through FCM. So the DEVICE_ID in the script should be an APNs device token.
I'm afraid you will have to contact Apple for further investigation, since you get the same error without using FCM.