Carillon docsProvider credentials
Upload and validate APNs keys and Firebase service accounts.
No notification can be sent until an APNs key or a Firebase service account has been uploaded. An app can have several credentials per provider. The newest non-revoked credential is selected for sending.
Apple
You need the .p8 key file, its 10-character Key ID, your Team ID, and the app's
Bundle ID.
A .p8 can be downloaded exactly once
Apple shows the file at creation and never again. If you no longer have it, generate a new key in your developer account rather than looking for the old one.
The Bundle ID is what APNs routes by: its topic. A credential that does not name an app cannot send
to one, and getting it wrong produces DeviceTokenNotForTopic on every delivery.
Use your existing Firebase project and create a dedicated service account for
Carillon within it. No separate Google Cloud project is needed. On that project,
grant the service account Firebase Cloud Messaging API Admin
(roles/firebasecloudmessaging.admin). It includes the
cloudmessaging.messages.create permission required to send through FCM v1.
Owner, Editor and Firebase Admin are not required.
Enable the Firebase Cloud Messaging API for the project, create a JSON key for that service account, then upload the whole JSON unchanged. The project ID is read from the file. Assign the role on the project's IAM page, to the service account principal; granting access to administer the service account itself does not grant permission to send messages in the project.
The JSON format alone does not determine privileges: IAM roles on its service account do. Prefer a dedicated account with the single messaging role over a broad Firebase Admin account. See Google's FCM authorization instructions and the role's permissions.
After upload
A credential is sealed on arrival and never readable again. What the page shows afterwards is
the key id, the team id, a truncated fingerprint, the date, and a status.
For FCM it also shows the service account's client_email and private_key_id
in the dashboard, API and credential_list MCP tool. These identify the Google
Cloud account and key; the private signing material remains unreadable.
If these identifiers are missing, upload the original JSON to display them.
| Status | Meaning |
|---|---|
| Never verified | Uploaded, not yet checked |
| Valid | The provider accepted it |
| Rejected | The provider refused it, and last_error carries their own word for why |
Validation is attempted at upload and daily afterwards. If the provider cannot be reached, there is no new validation result. A credential can stop working between checks; inspect delivery errors as well as its last validation time.
Rotating
Upload the new credential first, verify its status and send to a test device, then delete the old one. Uploading with the same provider and Key ID replaces that credential in place. Deleting the selected credential makes the next newest non-revoked credential eligible; deleting the last one leaves that provider without a credential.