Is FCM token secret?

As per the FCM docs: On initial startup of your app, the FCM SDK generates a registration token for the client app instance . If you want to target single devices or create device groups, you’ll need to access this token.

Firebase Cloud Messaging (FCM), formerly known as Google Cloud Messaging (GCM), is a cross-platform cloud solution for messages and notifications for Android, iOS, and web applications, which as of 2021 can be used at no cost.

Yes. A user could have multiple devices , a case where Device Groups are commonly used.

It doesn’t expire though.

According to this link, the registration token must be kept secret . Registration token: An ID generated by the FCM SDK for each client app instance. Required for single device and device group messaging. Note that registration tokens must be kept secret.

To cover all cases, you should adopt a threshold for when you consider tokens stale; our recommendation is two months. Any token older than two months is likely to be an inactive device; an active device would have otherwise refreshed its token .