0

How safe to provide GCM API key and GCM registration keys to third party servers (other than internal servers) ? Also, Do I need to create new API key for 3rd party server ? I need to understand how an untrusted server can misuse the GCM registration key.

AL.
  • 36,815
  • 10
  • 142
  • 281
Smitha Nandish
  • 25
  • 6
  • 1
    Possible duplicate of [FCM Security: Prevent multiple senders from pushing notifications to all devices?](https://stackoverflow.com/questions/43523967/fcm-security-prevent-multiple-senders-from-pushing-notifications-to-all-devices) – AL. Jun 29 '17 at 07:14

2 Answers2

0

Yes you can create API keys for every server, so that GCM will respond to only those server which were listed on your console

Lakhwinder Singh
  • 6,799
  • 4
  • 25
  • 42
0

If you provide the GCM API Key to a third party server, this server will be able to

  1. send notifications to the GCM registrations ids
  2. send notifications to topics
  3. subscribe / unsubscribe GCM registrations ids to topics

You can create a GCM API Key for every server,
so that you can invalidate it when your trust relationships ends.

Diego Giorgini
  • 12,489
  • 1
  • 47
  • 50