Push notifications

Configure FCM credentials so your Rails server can send push notifications to Android devices. If you haven't yet, set up the Rails side first.

Android delivery runs through Firebase Cloud Messaging (FCM). The action_push_native device model stores Android tokens with platform: "google".

#Create a Firebase project

Unlike iOS, Android push needs a Firebase project. Its config is compiled into your app, so this is a one-time step.

  1. Create a project at console.firebase.google.com.
  2. Add an Android app using the package name shown on the Push tab of your app in the Ruby Native dashboard.
  3. Download the google-services.json file. Firebase then prompts you to add the SDK and verify the install. Skip those steps. Ruby Native wires up Firebase when it builds your app.
  4. Upload google-services.json on the Push tab in the Ruby Native dashboard.

That covers the build-time half: the config baked into the app so it can receive notifications.

#Create an FCM service account key

To send notifications, your server needs a service account key from the same Firebase project.

  1. In the Firebase console, open your project and click the gear icon, then Project settings.
  2. Open the Service accounts tab.
  3. Click Generate new private key, then confirm. A JSON file downloads.

This JSON is a credential. Treat it like a password and do not commit it to your repo.

#If key creation is blocked

On a Google Cloud organization (common with Google Workspace accounts) the download can fail with:

Key creation is not allowed on this service account. Please check if service account key creation is restricted by organization policies.

Your organization enforces a policy that disables service account keys, and you need an organization admin to lift it:

  1. Open console.cloud.google.com and switch the resource picker at the top from your project to the organization. The role and policy below are only available at the organization scope, not a single project.
  2. In IAM, grant your own account the Organization Policy Administrator role.
  3. Go to IAM & Admin > Organization policies, find Disable service account key creation (iam.disableServiceAccountKeyCreation), and set it to not enforced for the organization.
  4. Wait a few minutes for the change to propagate, then retry Generate new private key.

#Configure FCM credentials

The contents of that JSON file go into your Rails credentials. Run bin/rails credentials:edit and add the fcm section:

action_push_native:
  fcm:
    project_id: your-firebase-project-id
    encryption_key: |
      {
        "type": "service_account",
        "project_id": "your-firebase-project-id",
        "private_key_id": "...",
        "private_key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n",
        "client_email": "...",
        ...
      }

Paste the JSON exactly as Firebase generated it. Keep the inner private_key value untouched, including its \n escapes. Every line must be indented deeper than encryption_key: so YAML reads it as one block.

The installer creates config/push.yml. Add a google section so the gem can send through FCM:

# config/push.yml
shared:
  google:
    project_id: <%= Rails.application.credentials.dig(:action_push_native, :fcm, :project_id) %>
    encryption_key: <%= Rails.application.credentials.dig(:action_push_native, :fcm, :encryption_key)&.dump %>

If your app also supports iOS, this sits alongside the existing apple section. The gem picks the right service per device automatically.