3

I have successfully registered my Android app with locally managed device groups as described here: Google Cloud Messaging (GCM) with local device groups on Android gives HTTP Error code 401.

This works fine, and I can send GCM messages from Android to Android by following the guidelines here: https://developers.google.com/cloud-messaging/downstream.

However, this uses the SERVER_API key, which supposedly isn't a nice thing to have lying around on a client.

My question is: Is it a problem at all to use the SERVER_API key on the client?

Second: Is it possible to send a GCM message without using the SERVER_API key?

I tried passing the notification_key received from the device group registration to this method, but nothing arrives:

private void sendMessage2(String recipient) throws IOException {
    Log.i(TAG, "Sending message to " + recipient);
    GoogleCloudMessaging gcm = GoogleCloudMessaging.getInstance(context);
    AtomicInteger msgId = new AtomicInteger();
    String id = Integer.toString(msgId.incrementAndGet());
    Bundle data = new Bundle();
    data.putString("hello", "world");
    gcm.send(recipient, id, data);
    Log.i(TAG, "Successfully sent message to " + recipient);
}

// recipient is the notification_key of the device group.
Community
  • 1
  • 1
Morten
  • 684
  • 1
  • 5
  • 15

1 Answers1

3

Don't use the SERVER_API key on your client!

This key is a secret, and will not be obfuscated in your binary. Someone can easily download your APK, run strings (or a similar tool) and then start sending GCM messages on behalf of your application.

If you want to do Android <--> Android messaging, you will actually need to do Android <--> Server <--> Android.

Sam Stern
  • 24,624
  • 13
  • 93
  • 124
  • So there isn't a way to send GCM messages without using the server key, since it requires the server key to send a message? – Morten Dec 18 '15 at 00:11
  • Yes that is correct. Android devices can only send to the server (using the GCM Android APIs) and then the server can send to other devices. – Sam Stern Dec 18 '15 at 22:35