Configuration

Configuration

Publish config/moztopia-notifications.php. Use independent secrets and transport credentials per application/environment. Restart long-running workers after changing configuration or credentials. Rebuild the Laravel configuration cache through the application's normal deployment process.

Application and security

NOTIFICATIONS_APPLICATION=example-application
NOTIFICATIONS_ENVIRONMENT=production
NOTIFICATIONS_FINGERPRINT_KEY=<independently-generated-secret-at-least-32-bytes>
NOTIFICATIONS_QUEUE_CONNECTION=database
NOTIFICATIONS_QUEUE=notifications

Generate a dedicated secret with a cryptographically secure generator, for example php -r 'echo bin2hex(random_bytes(32)), PHP_EOL;', and store the result in your application's secret store. Do not commit the output. Never reuse an example value, provider credential or Laravel APP_KEY as the fingerprint key.

Allowed transport environments are development, sandbox and production. Application identifiers are stable, nonempty strings of at most 120 bytes. Use a distinct application identifier for independently administered apps.

Tokens and internal payloads use Laravel's existing encrypter and APP_KEY. There is intentionally no second token-encryption implementation. Key rotation requires coordination with workers and uniqueness fingerprints.

FCM for Android

1. Create/select a Google project for FCM and enable the Firebase Cloud Messaging API.
2. Supply a service-account credential with permission to send FCM messages. Store the JSON outside the repository and public web root, or mount it from the deployment secret store.
3. Set these application environment variables:

FIREBASE_CREDENTIALS=/run/secrets/example-fcm-service-account.json
FIREBASE_PROJECT_ID=example-google-project
NOTIFICATIONS_FCM_PROJECT=app

NOTIFICATIONS_FCM_PROJECT selects the kreait/laravel-firebase project alias, normally app. The package maps FIREBASE_CREDENTIALS into that selected project's configuration and bounds the HTTP timeout using fcm_timeout (20 seconds by default). Existing Kreait configuration remains available for application-specific transport requirements. FIREBASE_PROJECT_ID participates in the registration scope; credentials must belong to that project.

Do not enable Firebase HTTP debug logging, request-body logging or token-bearing middleware. The adapter refuses configured Kreait HTTP logging channels. Firebase's SDK dependencies may include components for other services; this package resolves only Messaging and calls no authentication, database, analytics, storage or hosted management service.

References: FCM channel, Kreait Laravel configuration, FCM HTTP v1 setup.

Direct APNs for iOS

Enable Push Notifications for the Apple application identifier. Create an APNs authentication key, store its .p8 file outside source control, and obtain the key ID, team ID and bundle identifier.

APN_KEY_ID=<apple-key-id>
APN_TEAM_ID=<apple-team-id>
APN_BUNDLE_ID=com.example.application
APN_PRIVATE_KEY_PATH=/run/secrets/example-apns.p8
APN_PRODUCTION=true

APN_PRIVATE_KEY_CONTENT can be supplied by a secret manager instead of a path. Configure one private-key source. Production device registrations require APN_PRODUCTION=true; development/sandbox registrations require false. Match the signing entitlement/build distribution to the APNs environment. A sandbox token cannot be sent to the production endpoint.

The adapter constructs the dependency's Pushok client for each single-device channel call with bounded connection/request timeouts. It does not modify the host application's broadcasting configuration or use Firebase for iOS.

References: APNs channel, Apple APNs registration.

Defaults

The publishable file contains history enablement, a default 24-hour TTL, five attempts, backoff of 30/120/600/1800 seconds, queue settings, invalid-token cleanup, 30-day deduplication retention, seven-day delivery-detail retention and recovery batch size. The defaults section sets the default category and priority; payloads can override these, TTL and grouping. Custom data is JSON encoded into the provider-neutral data field.

Set positive retry, timeout and retention values. Ensure the queue connection's retry_after exceeds the worker timeout and provider HTTP timeouts. Configuration changes do not change the identity/scope of existing delivery intents; re-register devices when changing application, transport project, bundle or environment identities.