Skip to main content
The Guardian SDKs for iOS and Android allow you to use a custom-built app for vendor-specific push notification services. You can configure push notifications for the AWS Simple Notification Service (SNS) platform or use Direct to Vendor services to add Firebase Cloud Messaging (FCM) and Apple Push Notification (APN) credentials directly in Auth0.

​
AWS SNS Configuration

Before you configure push notifications, follow the prerequisites below:
  1. Create an SNS Platform Application using AWS Management console and note it’s ARN.
  2. Create an AWS Access Key ID authorized to create Platform Application endpoints. Guardian automatically creates a Platform Application endpoint with an appropriate device token as part of a successful enrollment.

​
Configure push notifications with AWS SNS

To receive push notifications from Guardian, you first need to override Guardian’s default SNS settings. Then, you can configure push notifications for Android and iOS.
  1. On the Auth0 Dashboard, navigate to Security > Multi-factor Auth and select Push via Auth0 Guardian. If the method is inactive, select the toggle at the top right to enable it.
  2. Select Custom to reveal additional settings.
  3. In the Push Notification Service section, choose Amazon SNS.
Auth0 Dashboard > Security > Multi-factor Auth > Guardian > Custom > Amazon SNS
  1. In the Amazon SNS Configuration section, complete the following fields:
  2. Select Save to complete your changes.

​
Configure push notifications for Android using FCM

To configure Android push notifications on your Auth0 Dashboard, first retrieve your FCM server credentials. For full details, review Google’s Firebase documentation.
  1. Navigate to the Firebase Console and select your applicable project.
  2. Open the Settings menu and choose Service Accounts.
  3. Select Generate New Private Key to download your credential file.
After you retrieve your credentials, you can configure push notifications on your Auth0 Dashboard.

​
Configure push notifications for iOS using APNs

To configure iOS push notifications on your Auth0 Dashboard, first retrieve your APN certificate and convert it to modern encryption.Keychain Access exports P12 files with legacy encryption (RC2 and Triple DES). Auth0 doesn’t accept P12 files with legacy encryption, so you must convert the file to modern encryption (AES-256-CBC) before you upload it. You need OpenSSL 3.0 or later to convert the file. The openssl command included with macOS is LibreSSL, which doesn’t support the options that the following steps use. On macOS, you can install OpenSSL with Homebrew:
  1. Generate a new APN certificate from your Apple developer account. Choose the Apple Push Notification service SSL (Sandbox & Production) type. For development and testing only, you can choose Apple Push Notification service SSL (Sandbox) instead.
  2. Install the certificate locally.
  3. Find the certificate in Keychain Access. Its name depends on the certificate type:
    • Apple Push Notification service SSL (Sandbox & Production): Apple Push Services: {AppId}
    • Apple Push Notification service SSL (Sandbox): Apple Sandbox Push Services: {AppId}
  4. Export the certificate and the associated private key to a P12 file (default name: Certificates.p12). When Keychain Access asks for a password to protect the exported items, leave the password empty.
  5. Convert Certificates.p12 to modern encryption. In a terminal, go to the folder that contains the file, and run the following commands:
    1. Set the OPENSSL shell variable to the openssl command that Homebrew installed, so that the following commands don’t use LibreSSL. If you installed OpenSSL 3.0 or later without Homebrew, use the full path to its openssl binary instead.
      The $OPENSSL version command shows your OpenSSL version. The output must show OpenSSL 3.0 or later, not LibreSSL.
    2. Extract the certificate and the private key to an intermediate apns.pem file. OpenSSL needs the -legacy option to read the legacy encryption.
    3. Create an apns.p12 file with modern encryption and no password. The new file uses Password-Based Encryption Scheme 2 (PBES2) with AES-256-CBC and a SHA-256 message authentication code (MAC).
    4. Delete apns.pem, because it contains your unencrypted private key:
  6. Before you upload apns.p12, check its encryption. Run the following command in the same terminal session, so that the OPENSSL variable is still set:
    Check the following three lines in the output:
    1. The MAC line shows sha256.
    2. The PKCS7 Encrypted data line, for the certificate, shows PBES2, PBKDF2, AES-256-CBC.
    3. The Shrouded Keybag line, for the private key, shows PBES2, PBKDF2, AES-256-CBC.
    The output should look similar to the following:
  7. Delete Certificates.p12, and use apns.p12 as the APN certificate in the Auth0 Dashboard. To upload the certificate with the Auth0 Management API instead, encode apns.p12 in base64:
    Use the output as the p12 value when you call the Update APNS Configuration endpoint. This endpoint overwrites the whole APNs configuration, so also include the bundle_id and sandbox values. To get the current values, call the Get APNS Push Notification Configuration endpoint.
After you retrieve your credentials, you can configure push notifications on your Auth0 Dashboard.

​
Learn more