Push Notifications

Push Notifications: Provisioning Handoff (PM Ticket)

Product: ArtistEvolve Mobile (React Native 0.85.1)

Author: Technical Lead

Purpose: Everything the PM needs to open one ticket that gets the Firebase, Apple APNs, and AWS AppSync accounts and credentials created and delivered so engineering can start Phase A of the push notifications build.

Companion doc: PUSH_NOTIFICATIONS_TECHNICAL_PLAN.md (full architecture). This document is the provisioning slice of that plan.

1. Why this ticket exists

Engineering cannot begin the push notifications build until the external accounts and keys are in place. These are the hard blockers on the critical path. All of it is account setup and credential generation, not code. This ticket tracks that provisioning work so the rest of the build can proceed.

The confirmed stack is Firebase Cloud Messaging (FCM) for delivery, Apple APNs behind FCM for iOS, and AWS AppSync for the real-time in-app notification center. genesis-web (our Express and MongoDB backend) does the sending and scheduling.

2. Suggested ticket

Title: Provision Firebase, Apple APNs, and AWS AppSync for mobile push notifications

Assignee: Rajib (setup and credential delivery)

Receiver: Shiraj

Priority: Highest (blocks Phase A of the push build)

Type: Task / Infrastructure

Summary: Create the Firebase project, register the iOS and Android apps, generate the Apple APNs auth key, provision AWS AppSync, and deliver all resulting config files and keys to engineering through the secrets vault. Acceptance is a successful end-to-end test push to a physical device.

3. Prerequisite decisions (resolve first, they unblock everything else)

#	Decision	Why it matters	Owner
1	Final iOS bundle identifier (for example `com.artistevolve.app`)	The iOS app is still on the React Native template placeholder. The bundle ID must be chosen before the Apple App ID, the Firebase iOS app, and the APNs setup, because all three reference it.	Rajib + PM
2	Confirm the Android package name stays `com.artistevolve85`	The Firebase Android app must match this exactly.	Rajib
3	Do we have an Apple Developer Program membership?	Required to create the App ID and APNs key. If not, purchasing it (99 USD per year) is itself a blocker to start now.	Rajib + PM
4	Who owns the Firebase and AWS billing accounts?	Credentials and billing should sit under a company account, not a personal one.	PM
5	AppSync auth model	Recommended: a Lambda or OIDC authorizer that validates our existing genesis-web JWT, so we avoid adopting Cognito. Confirm with backend.	Tech Lead + Backend

4. What to create and deliver

This is the full checklist. Each item lists what it is, where to get it, and where it will be used.

4.1 Firebase project and apps

Create a Firebase project at the Firebase Console under the company account. Suggested name: artistevolve or artistevolve-prod.
Register the iOS app in that project using the final bundle ID from decision 1. Download the generated GoogleService-Info.plist.
Register the Android app in that project using package name com.artistevolve85. Download the generated google-services.json.
Confirm Cloud Messaging is enabled for the project (it is on by default in current Firebase projects).
Generate a Firebase Admin service account key. In Project Settings, Service Accounts, Generate new private key. This downloads a JSON file. This is what genesis-web uses with the firebase-admin SDK to send pushes.

4.2 Apple APNs (required for iOS push, this is the piece that most often blocks teams)

App ID with Push enabled. In the Apple Developer portal, create or edit the App Identifier for the chosen bundle ID and enable the Push Notifications capability.
Create an APNs Authentication Key. In the Apple Developer portal, Keys, create a new key with Apple Push Notifications service (APNs) enabled. This produces a .p8 file. It can be downloaded only once, so store it immediately in the vault.
Record the Key ID (10 characters, shown when the key is created).
Record the Apple Team ID (10 characters, from the Apple Developer account membership page).
Upload the APNs key to Firebase. In the Firebase Console, the iOS app, Cloud Messaging, APNs Authentication Key section, upload the .p8 and enter the Key ID and Team ID. This is what lets FCM deliver to iOS devices.

We are deliberately using an APNs Auth Key (.p8) rather than APNs certificates. One key covers all our apps and it does not expire yearly, so this is lower maintenance.

4.3 AWS AppSync (real-time in-app notification center)

Confirm an AWS account under company billing and the target region (for example us-east-1).
Provision an AppSync GraphQL API. Deliver the API endpoint URL, the region, and the auth configuration decided in decision 5.
Deliver any client config the mobile Amplify client needs (endpoint, region, and the auth details), and the config genesis-web needs to call the AppSync mutation on send.

If AWS provisioning takes longer than the rest, it does not block the OS push work. AppSync only powers the live in-app updates (Phase E). Firebase and APNs (Phase A) are the true blockers, so prioritize those.

5. Credential inventory (the exact deliverables)

Deliverable	Source	Format	Used by	Sensitivity
`GoogleService-Info.plist`	Firebase iOS app	plist file	iOS app (`ios/` target)	Config, keep private
`google-services.json`	Firebase Android app	JSON file	Android app (`android/app/`)	Config, keep private
Firebase Admin service account key	Firebase Project Settings, Service Accounts	JSON file	genesis-web backend (`firebase-admin`)	Secret, high
APNs Auth Key	Apple Developer, Keys	`.p8` file	Uploaded to Firebase Console	Secret, high, one-time download
APNs Key ID	Apple Developer (shown at key creation)	10-char string	Firebase Console APNs config	Secret
Apple Team ID	Apple Developer membership page	10-char string	Firebase Console APNs config	Low
Final iOS bundle ID	Decision 1	reverse-DNS string	Xcode, Apple App ID, Firebase iOS app	Low
AppSync endpoint URL	AWS AppSync	URL	Mobile Amplify client, genesis-web	Config
AppSync region and auth config	AWS AppSync	values	Mobile Amplify client, genesis-web	Config to secret

6. Secure handoff (important)

The service account JSON and the APNs .p8 are secrets. Do not paste them into the ticket body, Slack, or email.

Put every file and key in the team secrets vault (for example 1Password or AWS Secrets Manager).
Share access with the mobile and backend engineers who need it.
In the ticket, link to the vault entry rather than attaching the files.
The APNs .p8 cannot be re-downloaded from Apple, so confirm it is safely stored before closing the key creation step.

7. Definition of done

The ticket is complete when all of the following are true.

Firebase project exists with both the iOS and Android apps registered under company billing.
GoogleService-Info.plist and google-services.json are in the vault and shared with mobile engineering.
The Firebase Admin service account JSON is in the vault and shared with backend engineering.
The APNs Auth Key (.p8), Key ID, and Team ID are generated, and the key is uploaded to the Firebase Console iOS Cloud Messaging settings.
The final iOS bundle ID is decided and recorded, and it matches across Xcode, the Apple App ID, and the Firebase iOS app.
The AWS account, region, AppSync endpoint, and auth model are provisioned and delivered (can trail the above if needed, since it only blocks Phase E).
Acceptance test: engineering sends a test push through Firebase and it is delivered to a physical iOS device and a physical Android device.

8. Dependencies and sequencing notes for the PM

The Apple pieces (developer membership, App ID, APNs key) are the most common source of delay. Start them on day one.
Firebase and Apple must both be done before the first iOS push can work, because FCM delivers to iOS only after the APNs key is uploaded.
The Android path is shorter. It needs only the Firebase project and google-services.json.
AppSync can run in parallel and finish later without blocking the OS push milestone.
Once these deliverables land in the vault, mobile engineering can begin Phase A native configuration immediately.