Getting Started
Configure platform credentials, register your first device token, and send a test notification end-to-end. This guide assumes you already have an iOS or Android app that can receive FCM or APNs tokens.
API credentials
Copy your Base64 Basic Auth token from the Sendexa dashboard under Settings → API Keys.
Push credentials
Upload FCM (Android) and/or APNs (iOS) credentials so Sendexa can deliver to your apps.
Register a device
Your app obtains a platform token; your backend registers it with POST /v1/push/devices.
Send a test push
Call POST /v1/push/send targeting that device, then verify delivery on a physical device.
api.sendexa.co
HTTPS only
Basic
Dashboard Base64 token
FCM
Service account JSON
APNs
.p8 key + Team ID
Authentication
Authorization: Basic <token>. Auth guide →Prerequisites
- A Sendexa business account with API access enabled
- Your dashboard Basic Auth token (Settings → API Keys)
- For Android: a Firebase project with Cloud Messaging enabled and a service account that can send messages
- For iOS: an Apple Developer account, an APNs Auth Key (.p8), Key ID, Team ID, and your app's Bundle ID
- A backend or script that can call
https://api.sendexa.cosecurely (never ship the Basic token in the mobile binary)
1. Configure push credentials in the dashboard
Sendexa stores your platform credentials encrypted and uses them only when sending on behalf of your business. Incomplete credentials return PUSH_CREDENTIALS_MISSING (HTTP 403) for the affected platform.
- Open the Firebase Console → Project settings → Service accounts.
- Generate a new private key (JSON). This is the FCM HTTP v1 service account.
- In Sendexa Dashboard → Products → Mobile Push → Credentials, upload the JSON and set the project ID if not inferred.
- Ensure Cloud Messaging API (V1) is enabled for the Google Cloud project linked to Firebase.
Server key deprecated
- In Apple Developer → Keys, create an APNs Auth Key (.p8). Download it once.
- Note the Key ID and your Team ID.
- In Sendexa Dashboard → Mobile Push → Credentials, upload the .p8 and enter Key ID, Team ID, and Bundle ID (e.g.
com.acme.app). - Choose environment: sandbox for development builds, production for App Store / TestFlight production tokens. You can store both.
Token vs certificate
2. Obtain a device token in your app
Your mobile app must request notification permission (where required) and retrieve the platform push token. Send that token to your backend; the backend then registers it with Sendexa.
// FirebaseMessagingService or startupFirebaseMessaging.getInstance().token.addOnCompleteListener { task ->if (!task.isSuccessful) return@addOnCompleteListenerval fcmToken = task.result// POST fcmToken to YOUR backend — never call Sendexa with the app secretapi.registerDevice(token = fcmToken, platform = "android")}// Also handle onNewToken for refreshesoverride fun onNewToken(token: String) {api.registerDevice(token = token, platform = "android")}
Use the official Firebase Android SDK. The token string is what you pass as token with platform: "android".
3. Register the device with Sendexa
From your backend, register or refresh the token. This call is idempotent for the same token: re-registering updates userId, platform, and topic memberships.
| Field | Type | Required | Description |
|---|---|---|---|
| token | string | required | FCM registration token (Android) or APNs device token hex (iOS). |
| platform | "ios" | "android" | required | Platform that issued the token. |
| userId | string | optional | Your internal user identifier. Enables type:user targeting. |
| topics | string[] | optional | Initial topic list (e.g. ["news", "orders"]). Max 50 topics per device. |
curl -X POST 'https://api.sendexa.co/v1/push/devices' \-H 'Content-Type: application/json' \-H 'Authorization: Basic YOUR_DASHBOARD_BASE64_TOKEN' \-d '{"token": "dG9rZW4tZXhhbXBsZS1mY20...","platform": "android","userId": "user_abc123","topics": ["news", "orders"]}'
Success response
{"success": true,"code": "DEVICE_REGISTERED","message": "Device token registered.","requestId": "REQ-1782000000100","timestamp": "2026-07-12T10:00:00.000Z","data": {"deviceId": "DEV-4f2a9c1e-88b0-4d2a-9f11-0c1d2e3f4a5b","token": "dG9rZW4tZXhhbXBsZS1mY20...","platform": "android","userId": "user_abc123","topics": ["news", "orders"],"createdAt": "2026-07-12T10:00:00.000Z","updatedAt": "2026-07-12T10:00:00.000Z"}}
4. Send a test notification
Target the device you just registered. Use a physical device or emulator with Google Play services / APNs sandbox as appropriate.
curl -X POST 'https://api.sendexa.co/v1/push/send' \-H 'Content-Type: application/json' \-H 'Authorization: Basic YOUR_DASHBOARD_BASE64_TOKEN' \-d '{"to": {"type": "device","value": "dG9rZW4tZXhhbXBsZS1mY20..."},"title": "Hello from Sendexa","body": "Your Mobile Push integration is working.","data": {"source": "getting-started","screen": "home"},"priority": "high"}'
Verify success
PUSH_QUEUED response means Sendexa accepted the job. Confirm the notification appears on the device, then configure webhooks for push.delivered and related events.| Layer | Responsibility |
|---|---|
| Mobile app | Permission UX, obtain token, handle notification tap & data payload |
| Your backend | Hold Basic token, register/unregister devices, send business pushes, process webhooks |
| Sendexa | Token store, topic fan-out, FCM/APNs delivery, status webhooks |
| FCM / APNs | Platform delivery to the handset |
| Symptom | Likely cause | Fix |
|---|---|---|
| 403 PUSH_CREDENTIALS_MISSING | FCM/APNs not uploaded for that platform | Complete dashboard credentials for ios or android |
| 400 INVALID_TOKEN | Truncated token or wrong platform value | Pass full token; match platform to issuer |
| Queued but nothing on device | Sandbox vs production APNs mismatch | Align APNs environment with the build that issued the token |
| Works on Android only | APNs key/bundle mismatch | Verify Team ID, Key ID, Bundle ID, and .p8 key |
| USER_HAS_NO_DEVICES | userId never attached at registration | Re-register with userId after login |
Security checklist
- Never embed the Sendexa Basic token or FCM service account in the mobile app binary.
- Register and unregister devices only from authenticated sessions on your API.
- Rotate dashboard API keys and APNs keys if they are exposed.
- Validate webhook signatures before trusting delivery or open events.