I'm creating an android app which uses firebase cloud messaging. As a result I have to store the fcm token in a database to send fcm to the device later. And I'm thinking of using firebase as a database to store these tokens.
I created an API using nodejs and redis to manage these tokens. It works, but I don't know how to protect my API to be used only by my mobile app. I had thought of create an API key, and store it in a configure file in my app. But this way, anybody who decompiles my app has access to this API key. Furthermore I'll have to buy a server to host this API.
Using firebase I won't have to make any server code, it will be secure, and accessible only by my app. The Flame plan cost 25$/month, it's not so expensive, and I don't know if I will need it.
So I'm thinking of changing the way the app works to migrate to a firebase database.
What do you think ?
PS : to use firebase in an android app, we have to put google-services.json in the app/ folder. In this file there is the API key, and all information about my google account. What if someone decompile my app ?