Questions developers ask
65 answers on push delivery, OTP costs and DLT, passkeys and push approval. Each links to the full article. Not here? Email hello@signops.dev.
Push notifications
Why do Expo push notifications work in Expo Go but not in my APK?
A standalone Android build sends through your own Firebase project, so it needs your google-services.json in the build and an FCM v1 service account key uploaded to EAS. Expo Go uses Expo's own credentials, which hides the problem until you build.
Expo push notifications work in development but not in the APK
Do Expo push notifications work in Expo Go on Android?
Recent Expo SDKs removed remote push notifications from Expo Go on Android. Test pushes in a development build made with EAS instead.
Expo push notifications work in development but not in the APK
The Expo push API says ok but nothing arrives. Why?
The ticket only means Expo accepted the message. Fetch the push receipt a few minutes later; errors such as DeviceNotRegistered or InvalidCredentials appear there, not in the ticket.
Expo push notifications work in development but not in the APK
Is the FCM legacy API still working?
No. Firebase deprecated sending through the legacy HTTP and XMPP APIs on 20 June 2023 and began shutting them down on 22 July 2024. Requests to fcm.googleapis.com/fcm/send with a server key no longer deliver. Use the HTTP v1 API.
Can HTTP v1 send to multiple tokens in one request?
No. One v1 request carries one message for one target, which can be a token, a topic or a condition. To reach many devices, send one request per token (the Admin SDK does this for you with sendEach and sendEachForMulticast) or subscribe the devices to a topic.
Where do I get the access token for Postman?
From a service account. Download its JSON key from the Firebase console under Project settings, Service accounts, then exchange it for a short-lived OAuth 2.0 token with the firebase.messaging scope, for example with the google-auth-library in Node or gcloud. The token lasts about an hour.
Do device tokens change when I migrate?
No. Tokens your app already has keep working with HTTP v1. Only the server side changes; the endpoint, the authentication and the payload shape.
Why does FCM return success but the device shows nothing?
A success response means FCM accepted the message, not that the phone displayed it. The usual reasons it does not show are a data-only message while the app is killed, a missing notification permission on Android 13 and later, a muted notification channel, a stale token, or a phone maker's battery saver stopping the app.
Why do notifications work when the app is open but not when it is closed?
With a data-only message, Android hands the message to your app's code, and if the app was swiped away on some phones or force-stopped, that code never runs. Send a notification message, which the system tray shows without your code, or a data message with high priority.
Does a force-stopped app receive FCM messages?
No. Android does not deliver broadcasts, including FCM, to an app the user force-stopped in Settings until the user opens it again. Some phone makers treat swiping an app away like a force stop.
Should every message be high priority?
No. High priority wakes the phone from Doze, and Android may lower the priority of apps that send high-priority messages without showing a notification. Use high priority for messages the user is waiting for, like a login approval or a delivery update.
Is Firebase Cloud Messaging free?
Yes. Firebase lists Cloud Messaging as no-cost on both the free Spark plan and the pay-as-you-go Blaze plan. There is no charge per message and no monthly cap.
What is the FCM free limit?
There is no message limit. There is a rate quota of 600,000 messages a minute per Firebase project by default, which Google can raise for projects that need more.
Do I pay for iOS pushes?
Apple charges nothing to send through APNs. You need the Apple Developer Program membership that every iOS app needs anyway.
Then why do push services charge?
For the server around FCM. Storing tokens per user, targeting topics, scheduling, retrying, removing dead tokens, a dashboard for non-developers and delivery logs are all work that FCM leaves to you.
Why are notifications not showing on my Xiaomi phone?
Xiaomi's MIUI and HyperOS stop apps in the background to save battery. If Autostart is off or battery saver restricts the app, its pushes are delayed or dropped. Turn on Autostart, set battery saver to No restrictions and allow notifications on the lock screen.
Why push notifications go missing on Xiaomi, Oppo, Vivo and Realme
Can an app turn off battery optimization by itself?
Not silently. An app can open the system screen where the user exempts it, using Android's battery optimization settings intent. Google Play allows asking for a direct exemption only for a few kinds of apps, so most apps should guide the user to the setting instead.
Why push notifications go missing on Xiaomi, Oppo, Vivo and Realme
Is this a Firebase problem?
No. FCM delivers to the phone; the phone maker's software decides whether your app may wake up and show it. The same message shows at once on a Pixel and late or never on a restricted Xiaomi.
Why push notifications go missing on Xiaomi, Oppo, Vivo and Realme
What is dontkillmyapp.com?
A community site that lists, phone maker by phone maker, how their battery management kills background apps and which settings undo it. It is the most useful single reference for this problem.
Why push notifications go missing on Xiaomi, Oppo, Vivo and Realme
How do I send a push notification to all users with Firebase?
Subscribe every device to a topic such as all when it registers, then send one message to that topic. HTTP v1 has no single call that reaches every token of a project.
Can I schedule a push notification with FCM?
Not from the API. FCM sends immediately. Schedule from your own server with a job queue or cron, or use the Firebase console's campaign scheduler for one-off messages.
How many tokens can sendEachForMulticast take?
Up to 500 tokens per call. For more, split the list, or use a topic.
Push authentication
What is push authentication?
Instead of typing a code, the user approves a sign-in on a phone they already use. The app shows who is signing in and from where, and the user confirms, usually with a biometric.
What is an MFA fatigue attack?
An attacker who has a user's password sends approval request after request until the user taps approve to make it stop. It is also called push bombing, and it was used in the 2022 Uber breach.
What is number matching?
The login screen shows a number and the phone asks the user to pick the same one. Only the person in front of that screen can answer, so spammed requests cannot be approved blindly. Microsoft made it mandatory in Authenticator in May 2023.
Is push authentication better than OTP?
With number matching and a signed challenge, yes for most logins; there is no code to read out to a caller and nothing for a SIM swap to catch. It only works on a phone that already signed in, so OTP or passkeys still cover signup and recovery.
Is the RBI banning SMS OTP?
No. The 2025 directions keep the requirement of two factors and stop naming a single method, so banks and payment companies can use SMS OTP alongside or instead of other factors.
When do the RBI authentication directions apply?
The Reserve Bank of India issued them on 25 September 2025, with compliance required by 1 April 2026.
Do the directions apply to my startup?
They apply to payment system providers and participants, which includes banks and non-bank payment companies. Apps that only sign users in, without moving money, are not covered, though the same methods are good practice.
Passkeys
Are passkeys better than OTP?
For sign-in, yes. A passkey only answers the website it was made for, so it cannot be phished, and there is no code to send, read or intercept. OTP is still useful to verify a new email or phone, and to recover an account when the passkey is lost.
Which phones support passkeys?
Android 9 and later, iOS 16 and later, and current Chrome, Safari, Edge and Firefox. Synced passkeys are backed up by Google Password Manager, iCloud Keychain or password managers such as 1Password.
Can I add passkeys to Flutter or React Native?
Yes. On Android they go through Credential Manager and on iOS through AuthenticationServices; Flutter and React Native packages wrap both, and your server must check the WebAuthn responses.
What happens if a user loses their phone?
Synced passkeys come back on the new phone through the same Google or Apple account. If not, let them in with an email code and ask them to make a new passkey.
OTP and email
Does Better Auth send the OTP email itself?
No. The email OTP plugin creates and checks the code, and calls your sendVerificationOTP function to deliver it. You choose the email provider.
What are the Better Auth email OTP defaults?
At the time of writing the docs list a 6-digit code, a 300-second expiry and 3 tries before the code is invalid. All three can be changed with otpLength, expiresIn and maxAttempts. Check the docs for your installed version.
Can I use Better Auth email OTP for sign-up and password reset?
Yes. The type passed to sendVerificationOTP tells you which flow it is (sign-in, email-verification, forget-password or change-email), so you can word each email differently.
Is email OTP more secure than SMS OTP?
It avoids SIM swap and SMS interception, but anyone with access to the inbox can read it, and both can be phished. Neither is as strong as a passkey or a signed push approval.
Which is cheaper in India, email or SMS OTP?
Email. An SMS OTP costs about Rs 0.10 to Rs 0.45 and needs DLT registration; an email code costs a few paise to send, and Rs 0.03 on SignOps.
Do I need DLT for email OTP?
No. DLT applies to commercial SMS in India. Email codes need a verified sending domain instead.
Does Firebase Auth support email OTP?
Not as a 6-digit code. Firebase Auth offers email link sign-in, where the user taps a link in the email. For a typed code, generate and check it yourself and sign the user in with a custom token.
Is a custom token safe to use for this?
Yes, if only your server creates it and only after it has checked the code. Custom tokens are created with the Admin SDK and your service account, which never leaves the server.
Why not just use email link sign-in?
Links open in whatever browser the email app chooses, which often is not the app the user started in. A code the user types back into the same screen avoids that, which matters most on phones.
How much does an SMS OTP cost in India?
Usually Rs 0.10 to Rs 0.45 per message in 2026, depending on the provider and your volume, plus 18% GST. MSG91 is around Rs 0.15 at base rates and Twilio around Rs 0.45.
Is DLT registration mandatory for OTP SMS?
Yes. Under TRAI's TCCCPR 2018 rules, every commercial SMS sent to Indian numbers, OTPs included, must come from a registered entity, sender id (header) and template on a DLT platform. Unregistered templates are blocked by the operators.
Can I send OTP without DLT registration?
Not by SMS through legitimate Indian routes. You can verify users without SMS, and so without DLT, by email OTP, WhatsApp authentication messages, push approval on a trusted phone, or passkeys.
Is WhatsApp OTP cheaper than SMS?
In India, Meta lists authentication messages at about Rs 0.115 each plus GST, which is a little cheaper than most SMS OTP routes, before any provider's fee.
What is Supabase's email rate limit on the free tier?
Supabase's built-in email sender is meant for testing and allows only a few auth emails an hour per project (2 an hour at the time of writing). Check Authentication, Rate Limits in your project for the current figure.
How do I increase the Supabase email rate limit?
Set up custom SMTP under Authentication, Emails, SMTP Settings with any email provider. Once custom SMTP is on, you can raise the email limit on the Rate Limits page.
Does Supabase charge for email OTP?
Supabase does not charge per email OTP; it sends through its built-in sender for testing or through the SMTP provider you configure, who bills you for the emails.
Providers and pricing
What is the best free push notification service?
For sending only, Firebase Cloud Messaging is free with no limit. For a service that also stores tokens per user, targets topics and schedules sends, OneSignal, Pusher Beams and SignOps are free for 1,000 users or devices.
Free push notification services for Android, iOS and the web
Is there a free push notification service for both Android and iOS?
Yes. FCM sends to Android and, with your APNs key, to iOS, free. Expo's push service is free for both on Expo apps. SignOps is free for 1,000 devices across Android, iOS and the web.
Free push notification services for Android, iOS and the web
Can I send push notifications without Firebase?
On iOS, yes, straight through APNs. On Android with Google Play services, FCM is the delivery path every service uses underneath. Phones without Google services, such as recent Huawei models, need the maker's own push service.
Free push notification services for Android, iOS and the web
What does MSG91 charge for OTP?
SMS OTP is about Rs 0.15 a message at base rates and about Rs 0.13 at high volume, plus GST. Its email plans start free for 5,000 emails a month, then Rs 2,000 a month with extra emails at Rs 0.02.
Does SignOps send SMS?
No. SignOps covers email OTP, push approval, passkeys and push notifications. Keep an SMS provider such as MSG91 for proving phone numbers at signup.
Can I use MSG91 and SignOps together?
Yes. A common setup is SMS through MSG91 once at signup, then SignOps push approval, passkeys or email codes for logins after that.
What changed on OneSignal's free plan?
From 1 September 2026 for new accounts and 1 October 2026 for existing ones, free mobile push and in-app messages stop above 1,000 monthly active users. Web push and email stay on the free plan's existing limits. Above 1,000, accounts get 24 hours to upgrade before mobile push pauses.
A OneSignal alternative, now that free mobile push stops at 1,000 users
What does OneSignal cost after the free plan?
The Growth plan is $19 a month plus $0.012 per monthly active user above 1,000. For 5,000 users that is about $67, or about Rs 5,900, a month.
A OneSignal alternative, now that free mobile push stops at 1,000 users
Is there a free OneSignal alternative?
Firebase Cloud Messaging and Expo's push service are free with no user limit, but you build the targeting, scheduling and dashboard yourself. SignOps is free for 1,000 devices and Rs 499 a month for 5,000.
A OneSignal alternative, now that free mobile push stops at 1,000 users
Can I move my OneSignal subscribers without an app update?
Yes, if your app already registers with Firebase. Export subscribers with their external user ids and push tokens, import them to SignOps by CSV or the API, and switch your server's send calls.
A OneSignal alternative, now that free mobile push stops at 1,000 users
Which is the cheapest OTP service provider in India?
For SMS, MSG91 is among the cheapest at about Rs 0.13 to Rs 0.15 a message. Email OTP is cheaper than any SMS, at Rs 0.03 a code on SignOps, and passkeys cost nothing per sign-in.
Can I get an OTP API without DLT?
For SMS in India, no. Every OTP SMS needs a DLT-registered entity, header and template. Email OTP, WhatsApp authentication messages, push approval and passkeys need no DLT.
Is there a free OTP API?
Most providers give trial credit rather than a free plan. SignOps gives 500 email codes to try, 100 push approvals a day and 10,000 passkey sign-ins a month free, with no card until you pass a free amount.
How much does Twilio Verify cost in India?
Twilio Verify charges $0.05 per successful verification, about Rs 4.40, plus a channel fee for SMS. Twilio's SMS to India is around Rs 0.45 a message. Verify Push is $0.05 a verification with no extra channel fee.
What is a cheaper alternative to Twilio Verify Push?
SignOps Approve is Rs 0.30 an approval, with 100 a day free and 1,000 a month included on Starter, about 15 times less than Verify Push.
Does SignOps support SMS like Twilio Verify?
No. SignOps covers push approval, passkeys and email OTP. For SMS in India, use a DLT-registered provider.
Send your first push today.
Free for 1,000 push devices, 100 approvals a day, 10,000 passkey sign-ins a month and 500 email codes to try. No card until you pass a free amount.