Azure Notification Hub: FCM V1 (The Push Notification System rejected the request because of an invalid credential)

Hi Guy Wouters,

The above error allow us to cross check the below points,

1. Make sure that the clientEmail, privateKey, and projectId you are using to configure the FCM V1 credentials in the Azure portal are correct. You can find these details in your Firebase console under Project settings > Service accounts.
2. Ensure the Project ID configured in your Azure Notification Hub matches the Project ID from your Firebase dashboard.
3. If you've registered both FCMv1 and legacy API credentials in the same hub, make sure that the FCMv1 credentials are placed after the GCM credentials if you're updating through the REST API.
4. Double-check that your Notification Hub name is consistent across all locations (registration, sending notifications, and service credentials). Typos can often lead to this kind of error.
5. You can use the Debug Send feature in Azure Notification Hubs to test sending notifications. This might help you identify any other issues within your setup.
6. Ensure that the Firebase Cloud Messaging API (V1) is enabled in your Firebase project settings, as this is essential for sending notifications via the FCM V1 protocol.

Few ask for better clarity -

1. Please confirm that the credentials are active and not expired?
2. Did you regenerate the credentials recently, and have you updated them in the Azure portal?
3. Are there any specific error codes or messages being returned beyond "invalid credential"?

If you have any further assistant, do let me know.

I can confirm that I have already tried the suggested steps multiple times.

I have regenerated the keys, thus they should not be expired.

I have checked multiple times that the keys are correct in the hub. I have tested with the 'test send' feature in the portal. I get one error message, but don't know where i can get more debug info. You talked about the Debug Send Feature, where can I find that?

Please advice further.

Hi Guy Wouters,

You can use Debug Send directly from the Azure Portal:

1. Navigate to your Notification Hub in the Azure Portal.
2. In the left-hand menu, click on "Test Send".
3. You'll see an option to "Send test notification".
4. Under "Platform", choose Android (FCM).
5. Click on "Debug Send" (a button next to "Send").

If you don’t see the Debug Send option, you can alternatively enable diagnostic logging and inspect the Activity Log or Azure Monitor logs for the Notification Hub resource.

1. Check Notification Hub Logs in Azure Monitor

• Go to the Notification Hub in Azure.
• Under "Monitoring", click "Diagnostics settings".
• Enable diagnostics to send logs to: Log Analytics Or Storage Account (if you want raw logs)
• After a failed test send, check Log Analytics > Logs:

    AzureDiagnostics
    | where ResourceType == "NOTIFICATIONHUBS"
    | order by TimeGenerated desc
  

  Look for any additional context beyond just "invalid credential".

2. Even though the service account is valid, make sure the account used has the Firebase Admin or Editor role. Sometimes when you generate a new service account, it does not inherit proper roles, which silently causes authorization failures. Check here: Go to Google Cloud Console > IAM. Find the service account (by email). Ensure it has at least the Firebase Admin or Editor role assigned.
3. Validate JSON Format in Azure Portal- When you paste the FCM V1 JSON credentials into Azure: Ensure the entire JSON content is copied without modification. Double-check there are no leading/trailing characters, line breaks, or formatting issues. The Azure Portal editor sometimes introduces errors if JSON isn’t properly escaped.
4. Force a Minimal Registration + Send- Use a simple device installation with tags and then try a minimal FCM payload via Debug Send:

{
  "notification": {
    "title": "Test",
    "body": "This is a test push"
  }
}

Make sure the test registration has a proper FCM token, and you're targeting it with either a tag or using Send to All.

If you have any further assistant, do let me know.

Hi,

The diagnostics setting are only available on Notification Hub Namespace, not in Notification Hub.

I enabled them on NHNS, but can't find any logs in Log Analytics.

Can you confirm that those diagnostics settings are on NH?

Hi Guy Wouters,

Yes let me correct myself that diagnostic settings for Azure Notification Hubs (NH) are configured at the namespace level, not at the individual Notification Hub level.

• You must configure diagnostic settings on the namespace resource in the Azure portal.
• The logs that are available include:
  • AzureActivity: Logs from operations in the Azure portal or ARM templates.
    • AzureDiagnostics: Logs from API or SDK-based operations.
• These logs are not enabled by default and must be explicitly configured to route to destinations like Log Analytics, Storage, or Event Hubs.

Troubleshooting Why Logs Aren’t Appearing in Log Analytics:

1. Confirm the Diagnostic Setting is Enabled: Go to your Notification Hub Namespace in the Azure portal. Under Monitoring > Diagnostic settings, ensure a setting is created and Log Analytics is selected as a destination.
2. Check Log Categories: Ensure that all relevant log categories (e.g., OperationalLogs) are selected in the diagnostic setting.
3. Verify Log Analytics Workspace: Make sure you're querying the correct workspace in Log Analytics. Use a query like-

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.NOTIFICATIONHUBS"
| sort by TimeGenerated desc

Wait Time: - Logs may take a few minutes to appear after enabling diagnostics.

References-notification-hubs-diagnostic-logs

If you have any further assistant, do let me know.