Skip to main content

Backend Configuration (Engage)

The backend (Engage) needs Huawei credentials to send to the HMS channel.

Who does this?

Only on‑prem / self‑hosted deployments configure this. If you use Paylisher's hosted services, Paylisher already configures Engage — you don't set these variables.

Unlike FCM (which uses a service‑account JSON + PEM private key), HMS needs only environment variables — no files.

Environment variables​

Engage supports two modes and picks v2 automatically when its variables are present.

v2 / central (recommended)​

One project‑level credential sends to all apps in the project (the Firebase‑like model):

HMS_PROJECT_ID=your-huawei-project-id      # AGC → Project settings → General information → Project ID
HMS_CLIENT_ID=your-project-client-id       # AGC → Users and permissions → API key → Connect API → API client (Project-level)
HMS_CLIENT_SECRET=your-project-client-secret

v1 / single app (fallback)​

HMS_APP_ID=your-app-id            # AGC → Project settings → General information → App information
HMS_APP_SECRET=your-app-secret

Optional​

# Dry-run: validate against real Huawei servers WITHOUT delivering (auth + payload check).
# Leave empty/false in production.
HMS_VALIDATE_ONLY=false
Use the API client credential, not a Service Account

HMS_CLIENT_ID / HMS_CLIENT_SECRET come from the API client tab (plain strings). The Service Account private.json uses JWT auth for management APIs and will not work for Push Kit. See [AppGallery Setup → step 7](../../Push Credentials/huawei-hms.md).

How routing works​

  • If v2 variables are set → v2 (/v2/{projectId}/messages:send); else if v1 variables are set → v1 (/v1/{appId}/messages:send); else HMS is disabled.
  • Each device carries a pushProvider tag. Engage routes hms tokens to the HMS sender and everything else (the default) to FCM.
  • FCM is never affected. When no HMS_* variables are set, the HMS code path does nothing and FCM behaves exactly as before.
  • OAuth tokens are cached (~1 hour). Secrets stay on the server only.

Verifying after deploy (no device needed)​

  1. Set HMS_VALIDATE_ONLY=true.
  2. Trigger an HMS send (any placeholder token works).
  3. Logs should show HMS Push Kit configured | api=v2 | key=<projectId>.
  4. A Huawei response of code 80000000 means auth + payload are correct (nothing is delivered).
  5. Remove/disable HMS_VALIDATE_ONLY afterwards.

Security​

Store the client secret in your secret manager / environment store — never commit it. HMS requires no key file, so there is nothing else to protect on disk.