{"registry_version":"2026.1025.387","generated_at":"2026-10-25T06:27:00Z","content_sha256":"089d16f627d9365e3d0663cc8069203706d7cb23a76c332226e29686968811a5","signed":true,"signature":{"key_id":"ed25519:74ca19268e364242","algorithm":"ed25519","expires_at":"2026-11-24T06:27:09Z","expired":false,"manifest":"/registry/manifest.json"},"id":"apple/apns-keys","name":"Apple Push Notification service (APNs) auth key","vendor":"Apple","status":"researched","last_verified":null,"last_researched":"2026-10-25","summary":"Create a token signing key (.p8) in your Apple Developer account so your server can send push notifications to your iOS, macOS, watchOS or tvOS apps over APNs using short-lived JSON Web Tokens instead of certificates.","account_model":{"summary":"APNs keys live under the organisation's (or individual's) Apple Developer Program membership, in Certificates, Identifiers & Profiles. Only the Account Holder or an Admin can create, download or revoke them. A key signs tokens for the whole team (team-scoped) or for chosen topics (topic-specific).","accounts":[{"name":"Apple Developer Program membership","kind":"developer","owned_by":"the company (or individual developer)","required":true},{"name":"Account Holder or Admin user","kind":"personal","parent":"Apple Developer Program membership","required":true,"note":"Needed to create and download keys."}],"notes":["One APNs connection cannot serve several teams; open separate connection pools per developer account."]},"prerequisites":[{"entry":"apple/developer-program-org","note":"An active paid membership (an individual membership also works)."}],"identity_requires":[],"have_ready":[{"kind":"other","description":"Account Holder or Admin access to the Apple Developer account.","why":"Required role for creating and downloading keys.","needed_for":["create-key","download-key"],"auto_check":"none","source_url":"https://developer.apple.com/help/account/keys/create-a-private-key/"},{"kind":"other","description":"A secure place to store the .p8 file (secret manager or vault) before you click Download.","why":"Apple keeps no copy; it can be downloaded only once.","needed_for":["download-key"],"auto_check":"none","source_url":"https://developer.apple.com/help/account/keys/revoke-edit-and-download-keys/"}],"steps":[{"id":"sign-in","title":"Sign in to Certificates, Identifiers & Profiles","summary":"Sign in to the Apple Developer account as Account Holder or Admin and open Keys.","route":"guided","gate":"2fa","human_only":true,"gate_label":"You enter a 2-step code","depends_on":[],"optional":false,"url":"https://developer.apple.com/account/resources","lead_time":null,"preflight":[],"captures":null},{"id":"create-key","title":"Create a key with APNs enabled","summary":"Click + under Keys, name the key, tick Apple Push Notification service and click Configure. Choose the environment (Sandbox or Production) and key type: team-scoped (any topic in the team, max two per environment) or topic-specific (chosen topics, max 200 per environment). Review and confirm.","route":"guided","gate":"human_submit","human_only":true,"gate_label":"You press submit","depends_on":["sign-in"],"optional":false,"url":"https://developer.apple.com/account/resources","lead_time":null,"preflight":[],"captures":null},{"id":"download-key","title":"Download the .p8 key once and store it safely","summary":"Click Download. The file AuthKey_<KEY_ID>.p8 lands in Downloads. Move it straight into your secret store; it cannot be downloaded again.","route":"guided","gate":"none","human_only":false,"gate_label":null,"depends_on":["create-key"],"optional":false,"url":null,"lead_time":null,"preflight":[],"captures":"APNS_PRIVATE_KEY"},{"id":"record-ids","title":"Record the Key ID and Team ID","summary":"Copy the 10-character Key ID shown for the key and your 10-character Team ID; the JWT header and claims need both.","route":"guided","gate":"none","human_only":false,"gate_label":null,"depends_on":["create-key"],"optional":false,"url":null,"lead_time":null,"preflight":[],"captures":null},{"id":"wire-server","title":"Sign provider tokens on your server","summary":"Sign an ES256 JWT with kid = Key ID, iss = Team ID and iat = now. Reuse each token for 20-60 minutes; APNs rejects tokens older than one hour and errors if you change tokens more often than every 20 minutes on one connection. Use the sandbox endpoint for development builds and production for released apps.","route":"guided","gate":"none","human_only":false,"gate_label":null,"depends_on":["download-key","record-ids"],"optional":false,"url":null,"lead_time":null,"preflight":[],"captures":null}],"gates":[{"step":"sign-in","gate":"2fa","label":"You enter a 2-step code"},{"step":"create-key","gate":"human_submit","label":"You press submit"}],"lead_times":[],"outputs":[{"name":"APNS_KEY_ID","description":"10-character Key ID of the APNs auth key (JWT kid header).","secret":false,"example_format":"ABC123DEFG","environments":null},{"name":"APNS_TEAM_ID","description":"10-character Apple Developer Team ID (JWT iss claim). Same value as APPLE_TEAM_ID.","secret":false,"example_format":"ABCDE12345","environments":null},{"name":"APNS_PRIVATE_KEY","description":"The .p8 token signing key (PEM text). Secret; never commit or send to clients.","secret":true,"example_format":"contents of AuthKey_<KEY_ID>.p8","environments":null}],"renewals":[{"what":"Provider authentication token (JWT) signed with the key; regenerate between 20 and 60 minutes","every":"60 minutes","every_days":null,"source_url":"https://developer.apple.com/documentation/usernotifications/establishing-a-token-based-connection-to-apns"}],"estimated_minutes":null,"guide_url":"https://verapli.com/guides/apple/apns-keys"}