What's the best way to store FCM tokens?

Question

I am trying to send push notifications programmatically to and iOS app using the Cloud Functions. In order to do this, I need to get the target user FCM token.

My idea of doing this is storing a dictionary of user emails and their FCM tokens on the real-time database. This way, whenever the Cloud Functions need to send a push notification to the user, it can look up the current token.

However, while looking at the docs, I noticed Firebase said this:

An ID generated by the FCM SDK for each client app instance. Required for single device and device group messaging. Note that registration tokens must be kept secret.

If FCM tokens need to be kept secret, then how should I send a push notification programmatically from Cloud Functions? Or is storing on the database "secret" enough?

Answer 1

Storing the token on the Firebase DB should be secured enough (I think the docs needs re-wording on this). Make sure that the node you plan to save the registration tokens is properly secured with the Firebase Rules - allowing only the corresponding users to read them. However since you're using Cloud Functions to read them, you should be fine.