FCM THIRD_PARTY_AUTH_ERROR (401): Fix iOS Push When Android Works

Android notifications arrive, but every iPhone send fails with 401 THIRD_PARTY_AUTH_ERROR or messaging/third-party-auth-error. Your code is probably fine. Firebase can't log in to Apple's push service with the key or certificate in your project.

What the error looks like

{
  "error": {
    "code": 401,
    "status": "UNAUTHENTICATED",
    "details": [
      {
        "@type": "type.googleapis.com/google.firebase.fcm.v1.FcmError",
        "errorCode": "THIRD_PARTY_AUTH_ERROR"
      }
    ]
  }
}

On iOS, FCM doesn't deliver the message itself. It passes it to Apple Push Notification service (APNs), signed with the APNs key or certificate you uploaded to Firebase. If APNs rejects that credential, FCM reports THIRD_PARTY_AUTH_ERROR. The Firebase Admin SDK for Node.js shows it as messaging/third-party-auth-error, with a message saying the APNs certificate was not uploaded or has expired.

The tell-tale sign: Android works and only iOS fails. That rules out your server code, your service account and the message format.

Common causes

• No APNs key or certificate uploaded for this iOS app in Firebase, often after adding a new app or a new Firebase project.
• Wrong Key ID or Team ID entered next to the .p8 key.
• The key was revoked in the Apple Developer portal, for example during a clean-up, while Firebase still uses it.
• An expired push certificate. Older .p12 certificates expire, and pushes stop on the day they do.
• Only one environment set up. With certificates, development and production are separate. A development certificate alone won't work for TestFlight or App Store builds.
• The wrong iOS app. The credential is attached to a different Apple app in Firebase than the bundle ID your build uses.

How to fix it

1. In the Apple Developer portal, open Certificates, Identifiers & Profiles → Keys and check that your APNs key exists and isn't revoked. If it's gone, create a new key with APNs enabled and download the .p8 file. Apple lets you download it only once.
2. In the Firebase console, open Project settings → Cloud Messaging, find the Apple app with your bundle ID, and upload the .p8 key with its Key ID and your Team ID.
3. If you used certificates, switch to the key. It covers sandbox and production and doesn't expire.
4. Send a test push to a real iPhone. The same device tokens work again once the credential is right.

The full setup is in the Firebase iOS push notifications guide.

Don't delete the tokens

Every iOS token fails at once, which can look like a mass uninstall. It isn't. Pause any automatic token clean-up until the key is fixed, or you'll lose every iPhone user's token for a configuration problem. Only delete tokens for errors that mean the token itself is dead, like UNREGISTERED.

Related errors

• SENDER_ID_MISMATCH (403): the token belongs to another Firebase project.
• INVALID_ARGUMENT (400): a bad token or a bad payload.
• No APNS token specified: the app asked for an FCM token before APNs registration finished.
• If you send to APNs directly instead of through FCM, a wrong environment shows up as BadDeviceToken.

On notifySphere

notifySphere sends iOS pushes through FCM with the Firebase credentials you add for each app, so the APNs key in your Firebase project still needs to be valid. Its React Native and Flutter SDKs handle APNs registration and the token for you.

Frequently asked questions