In a React Native app, what is a push device token, and which provider issues it on iOS and on Android?

## What the token is for A push notification travels from **your server** to a **push provider**, and from the provider to the device. Your server cannot address a phone directly; it needs an identifier the provider understands. That identifier is the **device push token**: - it identifies **one installation of one app** on one device, not a user and not a phone; - it is **opaque**: the app should store and send it as-is, never parse it; - it is **issued by the provider** through the operating system, not generated by the app. In a pharmacy app that sends "your prescription is ready" messages, the backend keeps a table of tokens per user, one row per installed device, and sends each order-status push to every row for that user. ## Which provider on each platform | | iOS | Android | |---|---|---| | Provider | **APNs** (Apple Push Notification service) | **FCM** (Firebase Cloud Messaging) | | Token issued via | the OS registering the app for remote notifications | Google Play services on the device | | App-side prerequisite | push capability (the `aps-environment` entitlement) in the signed build | Firebase config, `google-services.json` | | Server needs | Apple push credentials for the app | Firebase credentials for the project | Details worth knowing: 1. **React Native core is not the place to get tokens.** Core's iOS-only `PushNotificationIOS` is deprecated: it warns that it was extracted from core and will be removed. Tokens come from `expo-notifications` or `@react-native-firebase/messaging`. 2. With **React Native Firebase**, `getToken(getMessaging())` returns an **FCM token on both platforms**. On iOS, FCM still delivers through APNs underneath: the FCM SDK needs the APNs token first and maps its FCM token onto it. 3. With **expo-notifications**, `getDevicePushTokenAsync()` returns `{ type: 'ios', data }` with the raw APNs token on iOS and `{ type: 'android', data }` with the FCM token on Android. 4. **Expo push tokens** are a third option: `getExpoPushTokenAsync()` returns `ExponentPushToken[...]`, an address in Expo's push service, which then talks to APNs or FCM for you. ## The token's lifecycle A token is not a stable device ID. It can change when: - the app is reinstalled or its data is cleared; - the provider rotates it; - the app is restored onto a new device. So the app must: - fetch the token on startup (cheap, usually cached by the library); - **listen for changes**: `onTokenRefresh` in React Native Firebase, `addPushTokenListener` in `expo-notifications`; - send the current token to the backend, tied to the signed-in user, whenever it changes or the user signs in. The backend, in turn, deletes tokens the provider reports as no longer registered. ## What the token is not - **Not a secret credential.** Someone holding a token still needs your server's provider credentials to push to it, but you should keep tokens out of logs and analytics anyway, since they identify an install. - **Not a permission.** Getting a token and being allowed to show alerts are separate steps. On iOS the notification permission decides whether alerts are shown; on Android 13+ the `POST_NOTIFICATIONS` runtime permission does. - **Not portable across providers.** An APNs token is useless to FCM's API and vice versa, and an Expo push token only works with Expo's push service. ## Where the code lives in a React Native app Token handling is start-up plumbing, not screen logic: - fetch the token once the user is signed in, because the backend needs to know whose device it is; - register the refresh listener in a module or root component that lives for the whole session; - send token, platform and provider type together, since the backend must know whether a string is an APNs, FCM or Expo token before it can use it. In the pharmacy app this means a small `registerDevice` step after sign-in, reused on every launch, rather than code inside the order-status screen that may never be opened. ## How this is asked Junior interviews usually want three facts: tokens come from APNs on iOS and FCM on Android, the app must send them to its own backend, and they change over time. A good answer adds which library call produces the token in the project's stack and where the refresh listener lives.