How do I handle device token refresh for push notifications?

To handle device token refresh for push notifications, you generally want this flow:

1. Detect when the push token changes
2. Send the new token to your backend
3. Replace the old token in your database
4. Clean up invalid/expired tokens when sends fail

Why token refresh happens

Device tokens can change when:

• the app is reinstalled
• the user restores a device backup
• the OS or push service rotates the token
• the app’s push configuration changes

Client-side handling

In your app, listen for the token refresh callback/event provided by your push SDK:

• FCM (Android/iOS via Firebase): onNewToken(...)
• APNs (iOS): didRegisterForRemoteNotificationsWithDeviceToken
• React Native / Flutter / etc.: use the platform-specific token refresh listener

When you receive a new token:

• store it locally if needed
• immediately send it to your backend with the user/session identity

Example logic

• User logs in
• App gets push token
• App sends { userId, deviceId, pushToken, platform } to backend
• Backend stores it
• If token refreshes later, repeat the same call and overwrite the old token

Backend handling

Your backend should treat tokens as replaceable, not permanent.

Recommended approach:

• Store tokens with a unique device identifier if possible
• Keep fields like:
  • userId
  • deviceId
  • pushToken
  • platform
  • updatedAt
  • isActive

When a refreshed token arrives:

• find the existing record for that device/user
• update the token
• mark timestamp updated

When sending notifications

If the push provider says a token is invalid:

• remove or deactivate it from your database
• don’t keep retrying it

Examples:

• FCM may return errors like invalid registration token
• APNs may respond with BadDeviceToken or Unregistered

Best practices

• Register token changes immediately
• Associate tokens with devices, not just users
• Deduplicate tokens if users log in on multiple devices
• Prune dead tokens regularly based on delivery failures
• Handle logout by disassociating token from the user if appropriate
• Use secure transport when sending tokens to your backend

Simple flow

1. App requests notification permission
2. App receives push token
3. App sends token to backend
4. Backend stores token
5. Token changes later
6. App sends new token
7. Backend updates record
8. Notification send fails for old token
9. Backend deletes invalid token

If you want, I can show:

• platform-specific code for iOS, Android, or Firebase Cloud Messaging
• a backend schema for storing and rotating tokens
• an example in React Native, Flutter, or Node.js