Sending FCM Through a Proxy Does Not Route the Phone’s Connection
Separate Firebase’s Admin API route from the receiving Android device’s persistent FCM network connection.
A backend can successfully send a Firebase Cloud Messaging request through a corporate proxy while an Android device never receives the notification. The backend’s Admin API request and the device’s FCM connection are separate paths.
Firebase’s network guidance states that FCM’s device protocol cannot be proxied through a network proxy. Configuring an HTTP client on the sender does not convert that persistent device connection into an HTTP proxy request.
For Android devices, the documented TCP destination ports are 5228, 5229, 5230 and 443. FCM normally uses 5228, with the other ports available too. Apply the relevant policy on the network where the receiving devices connect.
Use Firebase’s published hostname guidance when a firewall restricts destinations; it discourages fixed IP allowlists because addresses can change. Devices also need working DNS and a stable path for their long-lived connection.
If the sender fails during token acquisition or an Admin API request, diagnose that server-side HTTP transport. For Firebase Admin Java’s HTTP interfaces, configure the API and credential transports together. If sending succeeds but delivery fails, preserve that result and investigate the device path rather than repeatedly replacing the backend’s proxy credentials.