Handling Push Notification Events and Deep Links in Android

Course: Android App Development

Topic: Handling Push Notification Events and Deep Links

Course Link: Android App Development Course

Demo Link: Register for a Course Demo

Official Website: JustAcademy

1. Introduction to Push Notifications and Deep Links

Modern Android applications use push notifications to inform users about important events, updates, messages, promotions, reminders, and account activity. Deep links allow users to open a particular screen or resource within an application instead of navigating through the entire app manually.

When these features work together, a notification can direct users to a relevant destination. For example, tapping a notification about a new message can open the conversation screen, while tapping an order update can open the corresponding order details page.

Handling these features correctly requires developers to understand notification delivery, user interaction events, Android activity navigation, intent processing, application lifecycle behavior, and security validation.

Key Concepts

• Push notification: A message delivered to an application through a push messaging service.
• Notification event: An action associated with receiving, displaying, or interacting with a notification.
• Deep link: A URL or application link that opens a specific destination within an app.
• Intent: An Android messaging object used to request an action from an application component.
• PendingIntent: A token that allows another component, such as Android's notification system, to execute a predefined intent on behalf of the application.
• Firebase Cloud Messaging (FCM): A messaging service commonly used to deliver push messages to Android applications.

2. Learning Objectives

• Understand push notification architecture in Android.
• Configure Firebase Cloud Messaging for an Android application.
• Handle foreground and background notification events.
• Create notification channels and display notifications.
• Process notification taps using PendingIntent.
• Understand implicit intents, explicit intents, and deep links.
• Configure Android App Links for verified web-to-app navigation.
• Pass identifiers and navigation information through intents.
• Handle deep links when the app is open, closed, or already running.
• Secure notification destinations and validate incoming data.
• Test notification behavior across Android versions and application states.

3. Understanding Push Notification Architecture

Push notifications generally involve a server, a messaging service, an Android device, and an application that handles the incoming message.

Typical Notification Flow

1. The user installs the Android application.
2. The application obtains an FCM registration token when available and required.
3. The application sends the token to its backend through a secure API.
4. The backend determines that a notification needs to be sent.
5. The backend sends a message through Firebase Cloud Messaging.
6. FCM delivers the message to the device when delivery is possible.
7. Android and the application process the message according to its payload type and current state.
8. The user taps the notification, and the application navigates to the relevant destination.

Delivery is not guaranteed to occur immediately. Device connectivity, notification permissions, battery restrictions, message priority, and other system conditions can affect delivery and presentation.

4. Setting Up Firebase Cloud Messaging

Firebase Cloud Messaging is commonly used to send notifications and data messages to Android devices.

Basic Setup Steps

1. Create or open a project in the Firebase console.
2. Add an Android application using its correct application ID.
3. Download the Firebase configuration file and place it in the appropriate app module.
4. Configure the Firebase Android SDK using the recommended Gradle setup.
5. Add the Firebase Messaging dependency.
6. Create a Firebase messaging service if custom message handling is required.
7. Request notification permission on Android versions where it is required.
8. Test notification delivery using a suitable test environment.

Gradle Dependency Example

Use the Firebase BoM to manage compatible Firebase library versions. The following is an illustrative Kotlin Gradle dependency declaration:

dependencies {
    implementation(platform("com.google.firebase:firebase-bom:34.0.0"))
    implementation("com.google.firebase:firebase-messaging")
}

The version shown is an example. Check the current Firebase documentation before using a version in a production project. Ensure that the Google services Gradle plugin and Firebase configuration are also set up correctly.

5. Understanding FCM Message Types

Firebase Cloud Messaging supports notification messages, data messages, and combinations of notification and data payloads.

Choose the message type according to the application's requirements. Do not assume that every message will invoke onMessageReceived() in every application state.

6. Creating a Firebase Messaging Service

Extend FirebaseMessagingService when the application needs custom handling for incoming FCM messages or registration token updates.

import android.util.Log
import com.google.firebase.messaging.FirebaseMessagingService
import com.google.firebase.messaging.RemoteMessage

class AppMessagingService : FirebaseMessagingService() {

    override fun onMessageReceived(message: RemoteMessage) {
        super.onMessageReceived(message)

        val title = message.notification?.title
        val body = message.notification?.body
        val data = message.data

        Log.d("FCM", "Message received")
        Log.d("FCM", "Title: $title")
        Log.d("FCM", "Body: $body")
        Log.d("FCM", "Data keys: ${data.keys}")

        // Decide whether to display a notification
        // or process a suitable application event.
    }

    override fun onNewToken(token: String) {
        super.onNewToken(token)

        // Send the updated token to your backend securely.
        Log.d("FCM", "FCM token updated")
    }
}

Register the service in the Android manifest:

<service
    android:name=".AppMessagingService"
    android:exported="false">
    <intent-filter>
        <action android:name="com.google.firebase.MESSAGING_EVENT" />
    </intent-filter>
</service>

Use a suitable package name and class location for your application. Avoid logging complete registration tokens or sensitive message contents in production. Send token updates to your backend over a secure connection.

7. Handling Foreground Notification Events

When an application is in the foreground, incoming FCM messages can be delivered to onMessageReceived(). The application can decide whether to display a notification, update the interface, refresh data, or perform another appropriate action.

Example: Handling a Foreground Message

override fun onMessageReceived(message: RemoteMessage) {
    super.onMessageReceived(message)

    val title = message.notification?.title ?: "New update"
    val body = message.notification?.body ?: "You have new information."

    // Display a local notification when appropriate.
    showLocalNotification(title, body, message.data)
}

The showLocalNotification() function is an application-defined helper that should create a notification channel, build a notification, and configure an appropriate tap action.

Applications should avoid displaying duplicate notifications. Establish a clear strategy for foreground messages, especially when the screen already displays the same content.

8. Handling Background Notification Events

When an application is in the background, FCM notification messages are generally displayed by the Android system. When the user taps the notification, the application is opened and can process the notification's associated data.

The handling approach depends on the message type:

• For a notification message, the system typically displays the notification while the app is in the background.
• For a data-only message, the application may process the message in its messaging service, subject to delivery restrictions and execution limits.
• For combined notification and data messages, data is commonly available through the launch intent after the user taps the background notification.

Test foreground, background, and terminated-process scenarios separately. Force-stopping an app through Android settings can prevent delivery until the app is manually launched again.

9. Creating Notification Channels

Android 8.0 (API level 26) and later require notification channels for ordinary notifications. A channel lets users manage the importance, sound, and visibility of a category of notifications.

import android.app.NotificationChannel
import android.app.NotificationManager
import android.content.Context
import android.os.Build

fun createNotificationChannel(context: Context) {
    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
        val channel = NotificationChannel(
            "general_updates",
            "General Updates",
            NotificationManager.IMPORTANCE_DEFAULT
        ).apply {
            description = "Notifications about application updates"
        }

        val manager = context.getSystemService(
            Context.NOTIFICATION_SERVICE
        ) as NotificationManager

        manager.createNotificationChannel(channel)
    }
}

Create the channel before posting notifications that use it. Once a channel is created, the user controls several of its settings. Changing the importance in code does not necessarily override the user's existing channel preferences.

10. Requesting Notification Permission

Android 13 (API level 33) and later require the runtime notification permission POST_NOTIFICATIONS for ordinary notifications.

Declare the permission in the manifest:

<uses-permission
    android:name="android.permission.POST_NOTIFICATIONS" />

Request the permission at an appropriate moment in the user journey on supported Android versions. The application should handle permission denial gracefully and should not assume that notifications can always be displayed.

Permission requests should be integrated with an Activity or another appropriate UI component. Do not attempt to request a runtime permission directly from a background messaging service.

11. Displaying a Notification with a Deep-Link Action

A notification can open a specific application screen by using a PendingIntent. The intent should contain the destination information, and the receiving activity should validate that information before navigating.

Example: Opening an Order Details Screen

import android.app.PendingIntent
import android.content.Intent
import androidx.core.app.NotificationCompat
import androidx.core.app.NotificationManagerCompat

fun showOrderNotification(
    context: Context,
    orderId: String
) {
    val intent = Intent(
        context,
        OrderDetailsActivity::class.java
    ).apply {
        putExtra("order_id", orderId)
        action = "com.example.app.OPEN_ORDER"
    }

    val pendingIntent = PendingIntent.getActivity(
        context,
        orderId.hashCode(),
        intent,
        PendingIntent.FLAG_UPDATE_CURRENT or
            PendingIntent.FLAG_IMMUTABLE
    )

    val notification = NotificationCompat.Builder(
        context,
        "general_updates"
    )
        .setSmallIcon(R.drawable.ic_notification)
        .setContentTitle("Order update")
        .setContentText("Tap to view your order")
        .setContentIntent(pendingIntent)
        .setAutoCancel(true)
        .build()

    NotificationManagerCompat.from(context)
        .notify(orderId.hashCode(), notification)
}

This example assumes that the notification channel exists, the small icon resource is available, and the receiving activity is implemented. Add the appropriate imports and adapt the package and resource names to your project.

For Android versions that require notification permission, check that permission has been granted before posting the notification. Use an appropriate, stable notification ID when you need to update an existing notification rather than create another one.

12. What Are Deep Links?

A deep link is a link that directs a user to a specific screen or resource within an application. Deep links improve navigation by allowing users to enter the application at the most relevant destination.

Examples

• https://example.com/products/42 opens product details for product 42.
• https://example.com/orders/105 opens order details for order 105.
• myapp://profile/25 uses a custom URI scheme to open a profile screen.

HTTPS links configured as Android App Links can be verified against a website domain. Custom URI schemes can be useful for application-specific navigation, but they do not provide the same domain verification guarantees.

13. Types of Deep Links

Prefer verified Android App Links for supported web-to-app destinations. Use custom schemes when appropriate and account for the possibility that another application may register the same scheme.

14. Configuring a Custom Deep Link

To handle a custom URI scheme, configure an intent filter on the activity that should receive the link.

<activity
    android:name=".DeepLinkActivity"
    android:exported="true">
    <intent-filter>
        <action android:name="android.intent.action.VIEW" />

        <category android:name="android.intent.category.DEFAULT" />
        <category android:name="android.intent.category.BROWSABLE" />

        <data
            android:scheme="myapp"
            android:host="profile" />
    </intent-filter>
</activity>

This configuration can match links such as myapp://profile/25. The receiving activity should inspect the URI, extract the intended identifier, validate it, and navigate only to an authorized destination.

15. Handling Deep Links in an Activity

The activity receives the incoming URI through its intent. For an activity launched with a new intent, implement onNewIntent() as well as initial intent handling.

import android.content.Intent
import android.net.Uri
import android.os.Bundle
import androidx.appcompat.app.AppCompatActivity

class DeepLinkActivity : AppCompatActivity() {

    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)

        handleDeepLink(intent)
    }

    override fun onNewIntent(intent: Intent) {
        super.onNewIntent(intent)
        setIntent(intent)

        handleDeepLink(intent)
    }

    private fun handleDeepLink(intent: Intent?) {
        val uri: Uri = intent?.data ?: return

        if (uri.scheme != "myapp") return
        if (uri.host != "profile") return

        val profileId = uri.lastPathSegment ?: return

        if (profileId.isBlank()) return

        // Validate the identifier and user authorization.
        // Navigate to the relevant profile screen.
    }
}

Do not assume that an incoming URI is safe merely because Android delivered it to the activity. Validate its scheme, host, path, parameters, and resource access before performing any action.

16. Configuring Android App Links

Android App Links use verified HTTPS URLs to connect a website to an Android application. When the association is correctly configured and verified, supported links can open directly in the app without the usual application chooser in appropriate circumstances.

Manifest Configuration

<activity
    android:name=".DeepLinkActivity"
    android:exported="true">
    <intent-filter android:autoVerify="true">
        <action android:name="android.intent.action.VIEW" />

        <category android:name="android.intent.category.DEFAULT" />
        <category android:name="android.intent.category.BROWSABLE" />

        <data
            android:scheme="https"
            android:host="example.com"
            android:pathPrefix="/orders" />
    </intent-filter>
</activity>

Replace example.com with your own domain. Ensure the application ID and signing certificate fingerprints are correctly represented in the website association file.

Digital Asset Links File

Host a file named assetlinks.json at the following location on your website:

https://example.com/.well-known/assetlinks.json

An illustrative file structure is shown below. Replace all example values with your actual Android application ID and signing certificate SHA-256 fingerprint.

[
  {
    "relation": [
      "delegate_permission/common.handle_all_urls"
    ],
    "target": {
      "namespace": "android_app",
      "package_name": "com.example.app",
      "sha256_cert_fingerprints": [
        "REPLACE_WITH_YOUR_SIGNING_CERTIFICATE_SHA256"
      ]
    }
  }
]

The file must be served over HTTPS with valid JSON. Make sure the certificate fingerprint matches the certificate used for the installed application, including the relevant Play App Signing certificate when applicable.

17. Opening Deep Links from Push Notifications

Push notifications frequently include data identifying the destination. For example, an order notification may include an order ID and a route type.

Example FCM Data Payload

{
  "message": {
    "token": "FCM_REGISTRATION_TOKEN",
    "notification": {
      "title": "Order shipped",
      "body": "Your order is on its way."
    },
    "data": {
      "type": "order",
      "order_id": "105"
    }
  }
}

This example illustrates the HTTP v1 message structure. In production, send messages from a trusted backend using the appropriate Firebase authentication mechanism. Never embed service-account credentials in an Android application.

Building the Destination Intent

val orderId = message.data["order_id"]

if (!orderId.isNullOrBlank()) {
    val intent = Intent(
        this,
        OrderDetailsActivity::class.java
    ).apply {
        putExtra("order_id", orderId)
    }

    // Pass this intent to a PendingIntent when
    // creating the notification.
}

When the user taps the notification, the receiving activity can retrieve the identifier and load the relevant order. Always confirm that the currently authenticated user has permission to view that order.

18. Handling Notification Tap Events

Notification taps are typically handled through the activity launched by the notification's PendingIntent. The activity reads the incoming intent and routes the user to the appropriate screen.

Reading Notification Data

class OrderDetailsActivity : AppCompatActivity() {

    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)

        val orderId = intent.getStringExtra("order_id")

        if (!orderId.isNullOrBlank()) {
            openOrder(orderId)
        } else {
            showDefaultScreen()
        }
    }

    private fun openOrder(orderId: String) {
        // Load the order from a repository or API.
    }

    private fun showDefaultScreen() {
        // Navigate to a safe default destination.
    }
}

For applications that reuse an existing activity, configure an appropriate launch mode and task stack strategy. Ensure that new notification intents are processed through onNewIntent() when Android delivers them to an existing activity instance.

19. Managing Navigation and Back Stack

When users enter an application from a notification or deep link, navigation should feel consistent with normal application use.

Consider the following questions:

• Should the destination open as a new activity or inside the existing navigation flow?
• What should happen when the user presses the Back button?
• Should the application show a parent screen before the destination?
• What should happen if the referenced item no longer exists?
• What should happen if the user is signed out?

For apps with multiple activities, Android navigation helpers such as TaskStackBuilder can construct a suitable parent stack for notification navigation. Apps using Jetpack Navigation should route the validated destination into the navigation controller rather than creating competing navigation stacks unnecessarily.

20. Using TaskStackBuilder for Notification Navigation

TaskStackBuilder can help create a synthetic back stack so that the Back button navigates to the appropriate parent destination.

import android.app.PendingIntent
import android.content.Context
import android.content.Intent
import androidx.core.app.TaskStackBuilder

fun createOrderPendingIntent(
    context: Context,
    orderId: String
): PendingIntent? {

    val destination = Intent(
        context,
        OrderDetailsActivity::class.java
    ).apply {
        putExtra("order_id", orderId)
    }

    return TaskStackBuilder.create(context)
        .addNextIntentWithParentStack(destination)
        .getPendingIntent(
            orderId.hashCode(),
            PendingIntent.FLAG_UPDATE_CURRENT or
                PendingIntent.FLAG_IMMUTABLE
        )
}

Configure the destination activity's parent relationship appropriately in the manifest or use the navigation structure supported by your application. The returned PendingIntent may be null, so handle that possibility where necessary.

21. Handling Authentication Before Navigation

A notification or deep link may refer to content that requires authentication. For example, a private message should not be displayed before the user signs in.

A recommended flow is:

1. Receive the incoming intent.
2. Validate the link and its destination parameters.
3. Check whether the user is authenticated.
4. If authentication is required, save the validated destination as pending navigation state.
5. Open the sign-in screen.
6. After successful authentication, revalidate authorization and open the requested destination.
7. If the destination is invalid or unauthorized, show an appropriate fallback screen.

Authentication alone does not guarantee access to a resource. The backend must also verify that the signed-in user is authorized to access the requested data.

22. Handling Duplicate Notification Events

Duplicate notifications or repeated taps can result in redundant API calls and repeated navigation. Applications should use consistent identifiers and idempotent processing to reduce these problems.

• Use a stable notification ID when an incoming event should update an existing notification.
• Choose PendingIntent request codes and intent identities carefully.
• Use unique event identifiers when processing server-originated actions.
• Avoid performing financial or irreversible operations merely because a notification was tapped.
• Make backend operations idempotent when repeated requests are possible.
• Clear or update notifications when their associated content becomes obsolete.

PendingIntent identity depends on the underlying intent's identity fields and request code. Extras alone do not distinguish PendingIntents, so use a suitable action, data URI, or request code when multiple distinct destinations must coexist.

23. Security Best Practices for Push Notifications and Deep Links

• Validate every incoming deep link before navigating.
• Prefer verified Android App Links for supported HTTPS destinations.
• Do not place passwords, access tokens, or confidential information in notification payloads.
• Use generic notification text when sensitive content might appear on a locked screen.
• Verify resource authorization on the backend.
• Keep sensitive activities protected from unintended external access.
• Use immutable PendingIntents when modification by another party is not required.
• Do not trust identifiers or URLs supplied by a notification without validation.
• Keep Firebase server credentials on a trusted backend.
• Use secure network connections and appropriate token handling.
• Avoid logging sensitive notification payloads or user information.
• Handle malformed URLs, missing parameters, expired content, and unauthorized destinations safely.

24. Common Problems and Troubleshooting

25. Testing Push Notifications and Deep Links

Testing should cover the major application lifecycle states, notification permissions, destination validation, and navigation behavior.

Recommended Test Cases

• Receive and handle a message while the application is in the foreground.
• Receive a notification while the application is in the background.
• Tap a notification when the application process is not currently running.
• Tap multiple notifications that point to different destinations.
• Open a valid custom-scheme deep link.
• Open a valid verified Android App Link.
• Test malformed URLs and missing identifiers.
• Test a deep link that points to deleted or inaccessible content.
• Test notification behavior when permission is denied.
• Test authentication-required destinations.
• Test Back button behavior after notification navigation.
• Test notification updates, cancellation, and duplicate events.

Testing Deep Links with ADB

You can test a custom deep link from a development machine using Android Debug Bridge:

adb shell am start \
  -a android.intent.action.VIEW \
  -d "myapp://profile/25"

For an HTTPS link, replace the URI with a suitable test URL:

adb shell am start \
  -a android.intent.action.VIEW \
  -d "https://example.com/orders/105"

Ensure that the application and device are configured for the relevant link. App Link verification can be inspected using Android's domain verification tools and device settings.

26. Practical Project: Notification-Driven Navigation

Project objective: Create an Android application that receives order notifications and opens the relevant order details page when a user taps a notification or opens a supported deep link.

Functional Requirements

• Receive order updates through Firebase Cloud Messaging.
• Display a notification with an appropriate title and message.
• Open the order details destination when the notification is tapped.
• Support a verified HTTPS App Link for order details.
• Handle foreground, background, and terminated-process scenarios.
• Require authentication when viewing private order details.
• Validate incoming order IDs and handle unavailable records.
• Avoid duplicate notifications and redundant navigation.
• Respect notification permission and channel preferences.

Suggested Development Steps

1. Configure Firebase and add the messaging dependency.
2. Create a Firebase messaging service and implement token updates.
3. Implement notification channel creation and permission handling.
4. Create a notification builder with a PendingIntent.
5. Build the order details activity or navigation destination.
6. Pass the order ID through the intent or deep link.
7. Configure the HTTPS intent filter and website association file.
8. Validate authentication and resource access before showing content.
9. Test notification behavior under different lifecycle states.
10. Test malformed links, permission denial, and unavailable order records.

27. Practice Exercises

1. Create an FCM messaging service that handles incoming data messages.
2. Display a notification for a new message while the app is in the foreground.
3. Create a notification channel for account updates.
4. Request notification permission on Android 13 and later.
5. Configure a PendingIntent that opens a product details screen.
6. Pass a product ID through the notification intent.
7. Configure a custom URI scheme for a profile page.
8. Configure an HTTPS App Link for order details.
9. Implement onNewIntent() to handle incoming links in an existing activity.
10. Build a sign-in flow that preserves a validated pending destination.
11. Test behavior when the target resource does not exist.
12. Prevent duplicate notification actions from triggering repeated processing.

28. Interview Questions and Answers

Q1. What is Firebase Cloud Messaging?

Firebase Cloud Messaging is a messaging service used to deliver notifications and data messages to supported client applications.

Q2. What is the purpose of FirebaseMessagingService?

It provides callbacks for handling applicable incoming FCM messages and registration token updates.

Q3. What is a PendingIntent?

A PendingIntent allows another component or the Android system to perform a predefined action on behalf of the application.

Q4. What is a deep link?

A deep link opens a particular screen or resource inside an application rather than simply opening its default screen.

Q5. What is the difference between a custom URI scheme and an Android App Link?

A custom URI scheme uses an application-defined scheme, while an Android App Link uses an HTTPS URL associated with a website and verified through Digital Asset Links.

Q6. How does notification handling differ between foreground and background states?

Foreground messages can be handled through the messaging callback, while background notification messages are generally displayed by the system. Tapping a notification can deliver its data through the launch intent.

Q7. Why is onNewIntent() important?

It allows an existing activity instance to process a newly delivered intent, including an incoming deep link, when the activity launch configuration reuses that instance.

Q8. Why should incoming deep links be validated?

Deep links can contain malformed or unauthorized destinations. Validation helps prevent unsafe navigation and unauthorized access to application resources.

Q9. What is a notification channel?

A notification channel groups notifications into a category whose importance and other presentation settings users can control.

Q10. What is the purpose of assetlinks.json?

It establishes the website-to-application association used by Android App Link verification.

Q11. Why should sensitive information not be included in push notification payloads?

Notification content and payload data can be exposed in logs or device interfaces. Sensitive resources should be retrieved securely after authentication and authorization.

Q12. How can deep links be tested?

Developers can use ADB commands, emulator testing, physical devices, and Android App Link verification tools to test link resolution and navigation behavior.

29. Quick Revision Checklist

• Understand FCM notification and data messages.
• Configure Firebase and the messaging service correctly.
• Distinguish foreground and background notification behavior.
• Create notification channels on supported Android versions.
• Handle notification permission on Android 13 and later.
• Use PendingIntent for notification actions.
• Understand custom schemes, HTTPS deep links, and Android App Links.
• Validate URIs, parameters, authentication, and resource permissions.
• Handle both onCreate() and onNewIntent() where appropriate.
• Configure website verification for Android App Links.
• Prevent duplicate actions and provide fallback navigation.
• Test notification and deep-link behavior across application lifecycle states.

30. Conclusion

Handling push notification events and deep links is an essential Android development skill. Firebase Cloud Messaging helps deliver messages, Android notification APIs present actionable updates, and PendingIntent connects notification interactions to the appropriate application destination.

Deep links improve the user experience by opening relevant screens directly. Reliable implementations validate incoming URLs, handle application lifecycle changes, manage authentication, respect notification permissions, and prevent unauthorized access to protected resources.

By combining FCM, notification channels, PendingIntent, and verified Android App Links, developers can build secure and user-friendly notification-driven navigation experiences.

To strengthen your Android development skills, explore the Android App Development course at JustAcademy, visit the JustAcademy official website, or register for a course demo.