# iOS Push (FCM → APNs) Setup

## Symptom

PM2 logs show:

```text
[FCM] iOS APNs delivery failed — verify Firebase Cloud Messaging APNs key ...
error_code: THIRD_PARTY_AUTH_ERROR
status: 401
```

Android push works. iOS push fails.

## Root cause

Firebase project **`aa59015-beeb`** accepts FCM requests, but **no APNs authentication key** is uploaded for the iOS app. Firebase cannot relay notifications to Apple.

Detected values for this project:

| Field | Value |
|-------|-------|
| Firebase project | `aa59015-beeb` |
| iOS bundle ID | `com.izdiharalufq.beebbeeb` |
| Apple Team ID | `BVZ9794FDX` |

## Fix (Firebase Console — one-time)

1. **Apple Developer** → [Certificates, Identifiers & Profiles → Keys](https://developer.apple.com/account/resources/authkeys/list)
   - Create a key with **Apple Push Notifications service (APNs)** enabled
   - Download the `.p8` file (only once)
   - Note **Key ID** and **Team ID**

2. **Firebase Console** → Project **`aa59015-beeb`** → ⚙️ **Project settings** → **Cloud Messaging**
   - Under **Apple app configuration** for `com.izdiharalufq.beebbeeb`
   - Upload the **APNs Authentication Key** (`.p8`)
   - Enter **Key ID** and **Team ID** (`BVZ9794FDX`)

3. **Verify from the server**

```bash
cd node
node scripts/verify-fcm-apns.js
node scripts/verify-fcm-apns.js --token "<ios-fcm-token>"
```

Expected: `apns_configured: yes` and `send_ok`.

4. **Restart PM2** (optional — Node auto-detects on next probe)

```bash
pm2 restart beebbeeb-socket-beebbeeb.sa.com
```

## Server behavior until APNs is configured

- **In-app notifications** still work (database rows)
- **Socket events** (`ride-active-state`, etc.) still work
- **iOS push** is skipped after detection to avoid log spam
- Android push is unaffected

## Notes

- Service account JSON (`storage/app/firebase_credentials.json`) is correct — Android delivery proves OAuth works
- There is **no public API** to upload the APNs `.p8` key; Firebase Console upload is required
- The iOS app must use the same Firebase project (`aa59015-beeb`) as the server credentials