Well, I figured it out myself and now I feel a little less an idiot. Hope someone else makes this useful.
The value for "Authorization" should be "Server Key" found in the Firebase console on the Cloud Messages tab of the project.
The "to" parameter is required. If it is omitted, the server will respond with a simple "to." In any case, it responds in nice JSON.
If you want to send a message to all devices, you must specify:
"to": "/topics/all"
The server response is only if you are successful:
{"message_id":4988221490411655075}
Here's what it looks like in case of any error:
{"multicast_id":5691752204334485119, "success":0, "failure":1, "canonical_ids":0, "results":[{ "error":"MissingRegistration" }] }
Parameters and return values are described here:
https://firebase.google.com/docs/cloud-messaging/http-server-ref
The Firebase console saves messages sent from the console itself.
For Cordoba, I use this simple plugin and it works great:
https://www.npmjs.com/package/cordova-plugin-fcm
Here is a well-formed JSON request to send using cURL in PHP (also included):
$json_data = '{ "data": { "price": "1000", "currency": "USD" }, "notification": { "title": "Hey you got a message", "body": "Your mother stil loves you", "sound": "default", "click_action": "FCM_PLUGIN_ACTIVITY", "icon": "icon_name" }, "to": "/topics/all", "priority": "high" }'; $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, 'https://fcm.googleapis.com/fcm/send'); curl_setopt($ch, CURLOPT_POST, 1); curl_setopt($ch, CURLOPT_HTTPHEADER, array( 'Content-Type: application/json', 'Content-Length: '.strlen($json_data), 'Authorization:key=AIzxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' )); curl_setopt($ch, CURLOPT_POSTFIELDS, $json_data); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); $output = curl_exec($ch); curl_close($ch);