The current FCM send endpoint
FCM HTTP v1 sends a message to a project-specific endpoint:
POST https://fcm.googleapis.com/v1/projects/PROJECT_ID/messages:sendThe request includes an OAuth bearer access token and a top-level message object.
Single-device notification payload
{
"message": {
"token": "DEVICE_REGISTRATION_TOKEN",
"notification": {
"title": "Test notification",
"body": "Hello from FCM HTTP v1"
}
}
}Why a service account is used
A non-Google server can use a service account private key to sign an assertion and request a short-lived token for the Firebase Messaging OAuth scope. The resulting bearer token authorizes the FCM v1 send request — see the access token guide for how that differs from a device token.
Notification, data, or both
The message object can carry a notification block, a data block, or both, and each behaves differently depending on whether the receiving app is foregrounded. See notification message vs data message for the details.
Legacy FCM migration
The legacy FCM HTTP and XMPP APIs were deprecated and their shutdown began in July 2024. Modern testing tools should use HTTP v1 or the Firebase Admin SDK instead of a static legacy server key.
Use the FCM tester to perform the authorization and HTTP v1 request from a simple form.