How do push notification services such as APNs and FCM work?

APNs (Apple Push Notification service) and FCM (Firebase Cloud Messaging) are two key technologies for delivering push notifications to iOS and Android devices respectively. Both services work by maintaining a persistent connection between the device’s operating system and the push service, which enables messages to be delivered almost immediately after they are sent.

APNs works by means of a unique device token, which is generated when an app registers for push notifications. When a server wants to send a notification, it sends it to APNs together with the device token, after which APNs delivers the message to the device in question. This process is designed to be secure and efficient, using the device’s existing connection to receive messages, even when the app is not active.

FCM works in a similar way and is the standard push service on Android. When an app registers for push notifications, it receives a unique registration token from FCM. The server then sends messages to FCM, which handles delivery to the correct device by means of this token. FCM also offers additional features such as message priority, topics and collapsible messages, where only the latest message of a given type is delivered, which can save battery and network resources.

Compared with approaches in which each app keeps its own connection open, both APNs and FCM are designed to be energy-efficient. A single low-power connection serves all apps, and the device only wakes when there is a message to deliver, which minimises battery consumption and allows devices to receive notifications quickly without draining the battery unnecessarily.

APNs is designed specifically for Apple devices and is deeply integrated with the iOS ecosystem, which ensures a high degree of reliability and security. When a notification is sent via APNs, it is handled directly by Apple’s servers, which means that developers do not need to worry about the complexity of the delivery infrastructure.

FCM, on the other hand, is a cross-platform service that supports both Android and iOS, which makes it a flexible choice for developers who want to reach a wider audience; on Apple devices, FCM itself delivers messages via APNs. FCM offers a range of features, including the ability to send messages to specific devices, subscription-based topics or user groups, which gives developers greater control over their notification strategy. In addition, FCM integrates seamlessly with Google’s ecosystem, which makes it a natural choice for Android developers.

Compared with APNs, which is limited to Apple devices, FCM offers a more versatile solution, especially for apps that need to work across several platforms. While APNs offers a strong security model and deep integration with iOS, FCM enables developers to benefit from Google’s extensive cloud services and analytics tools. The choice between APNs and FCM depends largely on the app’s audience and the specific requirements for notification functionality.

Push notifications are an effective way of improving the user experience, as they make it possible to deliver relevant and timely information directly to users’ devices. Push notifications are only sent when there is new information to share, which means that, used well, they do not constantly disturb the user but instead offer value when it is most needed. On iOS and, since Android 13, on Android, the user must first grant permission, so it pays to ask at a moment when the benefit is clear.

In addition, push notifications can be tailored to the individual user by means of data such as user behaviour and preferences. This makes it possible to send targeted messages that are relevant to the individual, which increases the chance of the user engaging with the content. With segmentation and personalisation, businesses can ensure that their notifications are perceived not as noise but as valuable updates.

Compared with other communication methods, such as emails, which can easily get lost in the inbox, push notifications offer a more direct and immediate way of reaching users. They are designed to be short and precise, which makes them ideal for capturing the user’s attention quickly and effectively. By optimising timing, content and frequency, push notifications can improve the user experience markedly without being intrusive.

When working with APNs (Apple Push Notification service) and FCM (Firebase Cloud Messaging), it is crucial to implement robust security measures to protect both data and the user experience. APNs and FCM are designed to deliver messages to devices securely, but it is important to understand and make use of the security features available.

First, all connections to APNs and FCM are protected with TLS (Transport Layer Security), which protects data in transit and guards against man-in-the-middle attacks. The encryption is between the servers and the device, however, and the push providers can see the content, so sensitive data should not be placed in the notification payload; instead, the app can fetch it securely after receiving the notification, or the content can be encrypted end to end by the app itself.

In addition, it is important to authenticate the server sending the messages, so that only authorised parties can send notifications to the app’s users. For APNs, this is done with a signing key (token-based authentication) or a certificate, and for FCM’s HTTP v1 API with short-lived OAuth 2.0 access tokens from a service account, as the older API keys for FCM’s legacy API have been discontinued. These keys must be kept secret, stored only on the server and rotated if they are exposed.

Finally, all activity related to APNs and FCM should be monitored and logged to detect and respond to suspicious behaviour. Monitoring tools can quickly identify potential security threats so that the necessary steps can be taken to mitigate them. This can include alerts for unusual access attempts or sudden increases in message traffic.

Compared with other messaging technologies, APNs and FCM offer a high degree of security, but it is crucial to make full use of these features to protect both applications and users. By implementing these security measures, a secure and reliable messaging experience can be ensured for everyone involved.

A device token, or registration token, is a unique identifier that an app receives from APNs or FCM when it registers for push notifications. The token acts as an address telling the notification service which app on which device a message should be sent to.

The app sends the token to its own server, which uses it when a notification is to be sent. Tokens can change, for example when the app is reinstalled or the data on the device is reset, so the server must update them continuously and remove tokens that are no longer valid. Tokens should be treated as confidential information.

Push notifications have developed markedly in recent years, and app developers should be aware of current trends to maximise user engagement and effectiveness. One of the most notable trends is the use of personalisation, where notifications are tailored to the individual user’s behaviour and preferences. This ensures that users receive relevant and interesting messages, which increases the likelihood of interaction.

In addition, there is a growing tendency to use rich media in push notifications, such as images, videos and interactive elements. These elements make notifications more engaging and can deliver more information in a visually appealing way. This is particularly effective in marketing campaigns, where visual content can capture the user’s attention faster than text alone.

Another important trend is the use of AI and machine learning to optimise the timing and frequency of notifications. By analysing user data, algorithms can predict the best times to send notifications, which reduces the risk of irritating users with too many messages. Operating systems are also moving in this direction, for example with summaries and focus modes that group less urgent notifications. This makes push notifications more effective and less intrusive, which improves the overall user experience.

Compared with earlier methods, where notifications were sent to all users at the same time, these new trends allow a more targeted and user-friendly approach. By implementing these strategies, app developers can ensure that their push notifications not only reach users but also create value and engagement.