How I built a scalable notification system that handles thousands of daily push notifications using PocketBase v0.27.2, Express.js, and Firebase Admin SDK v13
Press enter or click to view image in full size
Firebase push notification (pocketbase + express+ vercel+ firebase api v1)
Introduction: Why This Guide Matters
When I started building an e-commerce app that needed to notify users about order updates in real-time, I quickly realized that setting up push notifications is more complex than it initially appears. After weeks of trial and error, I’ve created a robust system that handles thousands of notifications daily.
In this comprehensive guide, I’ll walk you through exactly how I built a production-ready push notification system using:
PocketBase v0.27.2 as the backend database and API
Firebase Admin SDK v13 for push notifications
Express.js as a secure notification service
Vercel for reliable deployment
The Challenge: Why Standard Solutions Weren’t Enough
Most tutorials show you how to send a single push notification, but real applications need:
Automatic notifications triggered by database changes
Role-based notifications (customers, vendors, admins get different messages)
Secure API endpoints that can’t be abused
Batch processing for sending to multiple users
Error handling for failed notifications
Rate limiting to prevent spam
Let me show you how I solved each of these challenges.
Architecture Overview: The Big Picture
Before diving into code, here’s how all the pieces fit together:
switch (status) { case "pending": return `Your ${recordType} #${recordId} is being processed.`; case "in_progress": return `Your ${recordType} #${recordId} is now in progress.`; case "completed": return `Your ${recordType} #${recordId} has been completed successfully.`; case "cancelled": return `Your ${recordType} #${recordId} has been cancelled.`; default: return `Your ${recordType} #${recordId} status has been updated to ${status}.`; } } module.exports = { sendPushNotification, getUserTokens, createNotificationRecord, getUpdateMessage };
Part 4: Security and Rate Limiting
Security was a major concern. Here’s how I handled it:
1. API Key Authentication
// Use a strong, randomly generated API key const API_SECRET_KEY = "your_very_secure_random_string_here_minimum_32_chars";
// Always use timing-safe comparison if (!crypto.timingSafeEqual(expectedBuffer, providedBuffer)) { return res.status(401).json({ error: 'Invalid API key' }); }
2. Rate Limiting
// Global rate limit const globalLimiter = rateLimit({ windowMs: 15 * 60 * 1000, // 15 minutes max: 100 // limit each IP to 100 requests per windowMs });
// Notification-specific rate limit const notificationLimiter = rateLimit({ windowMs: 1 * 60 * 1000, // 1 minute max: 10 // limit each IP to 10 notification requests per minute });
// Validate tokens array if (!tokens || !Array.isArray(tokens) || tokens.length === 0) { return res.status(400).json({ success: false, error: 'tokens must be a non-empty array' }); }
// Limit batch size if (tokens.length > 1000) { return res.status(400).json({ success: false, error: 'tokens array too large (max 1000)' }); }
// Validate each token format for (const token of tokens) { if (typeof token !== 'string' || token.length < 10 || token.length > 200) { return res.status(400).json({ success: false, error: 'Invalid token format' }); } }
// Validate title and body if (!title || typeof title !== 'string' || title.length > 100) { return res.status(400).json({ success: false, error: 'title must be a string (max 100 chars)' }); }
if (!body || typeof body !== 'string' || body.length > 500) { return res.status(400).json({ success: false, error: 'body must be a string (max 500 chars)' }); }
next(); };
Part 5: Deploying to Vercel
Deploying to Vercel was straightforward once I got the configuration right:
// Add this to your Express app app.get('/health', (req, res) => { const apps = getApps(); res.json({ status: 'healthy', timestamp: new Date().toISOString(), firebase: isFirebaseReady, firebaseApps: apps.length, firebaseError: firebaseInitError, environment: process.env.NODE_ENV || 'development' }); });
Monitoring Script
// Simple monitoring script you can run periodically async function checkNotificationService() { try { const response = await fetch('https://your-service.vercel.app/health'); const data = await response.json();
if (data.status === 'healthy' && data.firebase) { console.log('✅ Notification service is healthy'); } else { console.error('❌ Service issues detected:', data); } } catch (error) { console.error('❌ Service is down:', error.message); } }
Common Pitfalls and Solutions
1. Firebase Private Key Format Issues
Problem: The private key environment variable is the most common source of errors.
Solution: Always wrap your private key in quotes and ensure \n characters are properly escaped:
Solution: Implement token cleanup in your PocketBase hooks:
// Clean up invalid tokens function cleanupInvalidTokens(invalidTokens) { invalidTokens.forEach(token => { try { const tokenRecord = $app.findFirstRecordByFilter( "device_tokens", `fcm_token = "${token}"` ); if (tokenRecord) { $app.delete(tokenRecord); } } catch (error) { console.error('Error cleaning up token:', error); } }); }
3. Rate Limiting Issues
Problem: Hitting rate limits during high traffic.
Solution: Implement exponential backoff and queue management:
// Simple retry mechanism with exponential backoff async function sendWithRetry(tokens, title, body, retries = 3) { for (let i = 0; i < retries; i++) { try { const result = await sendPushNotification(tokens, title, body); if (result.success) return result; } catch (error) { if (i === retries - 1) throw error; await new Promise(resolve => setTimeout(resolve, Math.pow(2, i) * 1000)); } } }
Performance Optimization Tips
Batch Processing: Always send notifications in batches of 500 (Firebase’s limit)
Token Deduplication: Remove duplicate tokens before sending
Async Processing: Use PocketBase hooks for async notification sending
Caching: Cache frequently accessed user tokens
Error Handling: Implement comprehensive error logging and recovery
Conclusion: Lessons Learned
Building this notification system taught me several valuable lessons:
Security First: Always implement proper authentication and rate limiting
Firebase SDK v13: The new version requires careful initialization but offers better performance
PocketBase Hooks: Version 0.27.2 hooks are incredibly powerful for automation
Vercel Deployment: Environment variable management is crucial for success
Error Handling: Comprehensive logging makes debugging much easier
The system now handles thousands of notifications daily with 99.9% reliability. Users receive instant updates about their orders, and the admin team can monitor everything through detailed logs.
If this guide helped you build your notification system, please give it a clap and share it with other developers!
