How to invalidate 'expired' Firebase Instance ID Token

Question

AFAIK, the Firebase Instance Token will be refreshed under the following 4 conditions:

1. App deletes Instance ID

2. App is restored on a new devi

Answer 1

Keeping your token registry up to date requires two steps:

1. Remove outdated tokens from your application code.
2. Check for outdated tokens and remove them when you send messages.

Your approach of removing a token that is no longer used, is #1.

The second step though is to remove tokens from your registry/database when you get a messaging/invalid-registration-token or messaging/registration-token-not-registered response when trying to send a message to it. The functions-samples repo contains a great example of this:

admin.messaging().sendToDevice(tokens, payload).then((response) => {
  // For each message check if there was an error.
  const tokensToRemove = [];
  response.results.forEach((result, index) => {
    const error = result.error;
    if (error) {
      console.error('Failure sending notification to', tokens[index], error);
      // Cleanup the tokens who are not registered anymore.
      if (error.code === 'messaging/invalid-registration-token' ||
          error.code === 'messaging/registration-token-not-registered') {
        // TODO: remove the token from your registry/database
      }
    }
  });
});

The above code uses the Firebase Admin SDK for Node.js, but the same logic could also be applied to other platforms or when sending messages through the HTTPS endpoints.

Answer 2

As Frank mentioned in his answer you can remove them when sending messages and getting not registered error.

Here how I delete outdated registration tokens when registering a new one using C#.

First of all using Instance ID API I get token info as following:

 public async Task<FCMTokenInfo> GetTokenInfoAsync(string token)
    {
        try
        {
            HttpClient client = new HttpClient();

            client.BaseAddress = new Uri("https://iid.googleapis.com");
            client.DefaultRequestHeaders.TryAddWithoutValidation("Authorization", String.Format("key={0}", "your-authorization-key"));

            var uri = $"/iid/info/{token}";

            var httpResponse = await client.GetAsync(uri);
            var responseStr = await httpResponse.Content.ReadAsStringAsync();

            if (httpResponse.StatusCode != HttpStatusCode.OK)
            {
                //log 400 bad request and do whatever you want
            }

            var result = JsonConvert.DeserializeObject<FCMTokenInfo>(responseStr);
            return result;
        }
        catch (Exception ex)
        {
            //log the exception
            throw;
        }
    }

FCMTokenInfo.cs

public class FCMTokenInfo
{
    public string Application { get; set; }
    public string Subtype { get; set; }
    public string Scope { get; set; }
    public string AuthorizedEntity { get; set; }
    public string Platform { get; set; }
}

And then inside the service that saves registration tokens inside the database:

//this method gets called when a new token is sent by the javascript web app
public async Task AddTokenAsync(Guid accountId, string token)
    {
        try
        {

            //getting TokenInfo of the current token(or refreshed one for that app)
            var fcmTokenInfo = await firebaseServices.GetTokenInfoAsync(token);

            //adding the current token
            dbContext.FcmRegisterationTokens.Add(new FcmRegisterationToken
            {
                Token = token,
                AccountId = accountId,
                AddingDate = DateTimeOffset.UtcNow,
                Application = fcmTokenInfo.Application,
                Subtype = fcmTokenInfo.Subtype,
                AuthorizedEntity = fcmTokenInfo.AuthorizedEntity,
                Scope = fcmTokenInfo.Scope,
                Platform = fcmTokenInfo.Platform
            });

            var outdatedTokens = await dbContext.FcmRegisterationTokens
                                         .Where(x => x.AccountId == accountId
                                                  && x.Application == fcmTokenInfo.Application
                                                  && x.Platform == fcmTokenInfo.Platform
                                         ).ToListAsync();

           //remove them
            dbContext.FcmRegisterationTokens.RemoveRange(outdatedTokens);

            dbContext.SaveChanges();
        }
        catch (Exception)
        {
             throw;
        }

    }