instanceid

InstanceID is a client‑side identifier used by several Google services to uniquely distinguish an installation of an application on a device. It was introduced as part of Google Cloud Messaging (GCM) and later adopted by Firebase Cloud Messaging (FCM) and other Firebase products. The identifier is generated by the SDK when the app first runs and is stored persistently, allowing back‑end servers to address a specific app instance for push notifications, analytics, or configuration updates.

The InstanceID service provides methods to obtain the current token, refresh it, and delete it when the app is uninstalled or the user signs out. Tokens are typically short‑lived; they are rotated automatically by the SDK to enhance security and reduce the impact of token leakage. Developers can listen for token refresh events and propagate the new token to their servers.

In 2020 Google announced the deprecation of the InstanceID API in favor of the Firebase Installations API. The newer API offers a more stable and privacy‑focused approach, delivering a stable installation identifier while handling token management through the Firebase Cloud Messaging service. Existing applications that rely on InstanceID can continue to function but are encouraged to migrate to Firebase Installations to receive ongoing support and security updates.

Security considerations include treating tokens as sensitive data, transmitting them over TLS, and revoking them promptly if compromise is suspected. InstanceID has been used in analytics, remote configuration, and A/B testing, but its primary role remains the reliable targeting of individual app installations for messaging services.