verapli
Sign inJoin free
Menu

Guides · messaging · Verification-gated

Apple Push Notification service (APNs) auth key

Create a token signing key (.p8) in your Apple Developer account so your server can send push notifications to your iOS, macOS, watchOS or tvOS apps over APNs using short-lived JSON Web Tokens instead of certificates.

Researched · not yet run liveLast researched 25 October 2026 · Apple · provider site

Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Do this with verapliJSON for agents

Who owns what

APNs keys live under the organisation's (or individual's) Apple Developer Program membership, in Certificates, Identifiers & Profiles. Only the Account Holder or an Admin can create, download or revoke them. A key signs tokens for the whole team (team-scoped) or for chosen topics (topic-specific).

  • Apple Developer Program membership developer owned by the company (or individual developer)
  • Account Holder or Admin user personal · under Apple Developer Program membershipNeeded to create and download keys.

One APNs connection cannot serve several teams; open separate connection pools per developer account.

Have ready

  • Account Holder or Admin access to the Apple Developer account. · Required role for creating and downloading keys. [2]Needed for: Create a key with APNs enabled, Download the .p8 key once and store it safely
  • A secure place to store the .p8 file (secret manager or vault) before you click Download. · Apple keeps no copy; it can be downloaded only once. [3]Needed for: Download the .p8 key once and store it safely

Steps

Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.

  1. Sign in to Certificates, Identifiers & Profiles

    Sign in to the Apple Developer account as Account Holder or Admin and open Keys.

    • Guided by hand
    • Human step: You enter a 2-step code

    Where: https://developer.apple.com/account/resources

  2. Create a key with APNs enabled

    Click + under Keys, name the key, tick Apple Push Notification service and click Configure. Choose the environment (Sandbox or Production) and key type: team-scoped (any topic in the team, max two per environment) or topic-specific (chosen topics, max 200 per environment). Review and confirm.

    • Guided by hand
    • Human step: You press submit
    • After: Sign in to Certificates, Identifiers & Profiles
    If something goes wrong (1)
    • You cannot create another team-scoped key.: Each environment allows at most two team-scoped keys. Revoke an unused one (check nothing depends on it first) or use a topic-specific key. [1]

    Where: https://developer.apple.com/account/resources

  3. Download the .p8 key once and store it safely

    Click Download. The file AuthKey_<KEY_ID>.p8 lands in Downloads. Move it straight into your secret store; it cannot be downloaded again.

    • Guided by hand
    • After: Create a key with APNs enabled

    verapli captures APNS_PRIVATE_KEY here by plain code: encrypted in your browser, never shown to AI.

    If something goes wrong (1)
    • The Download button is greyed out.: The key was already downloaded. If you no longer have the file, create a new key, switch your server to it, then revoke the old one. [3]

  4. Record the Key ID and Team ID

    Copy the 10-character Key ID shown for the key and your 10-character Team ID; the JWT header and claims need both.

    • Guided by hand
    • After: Create a key with APNs enabled

  5. Sign provider tokens on your server

    Sign an ES256 JWT with kid = Key ID, iss = Team ID and iat = now. Reuse each token for 20-60 minutes; APNs rejects tokens older than one hour and errors if you change tokens more often than every 20 minutes on one connection. Use the sandbox endpoint for development builds and production for released apps.

    • Guided by hand
    • After: Download the .p8 key once and store it safely, Record the Key ID and Team ID
    If something goes wrong (4)
    • APNs returns ExpiredProviderToken.: The token's iat is over an hour old; generate a fresh token and refresh at least every 60 minutes. [1]
    • APNs rejects pushes after you refresh tokens frequently.: Refresh no more than once every 20 minutes on the same connection; cache the token. [1]
    • Pushes to a newly added bundle ID or another team fail on an existing connection.: Add the topic to your team, then open new connections; a connection is bound to one team and its bundle IDs at first push. [1]
    • Pushes stop after an app transfer.: Close and recreate connections from your push server to APNs so they bind to the new team. [1]

Terms and gotchas

Plain-English summary, not legal advice. Each card links its source.

Can get you bannedThe rules say

Guard the key

You are fully responsible for safeguarding authentication credentials (keys, tokens) tied to your developer account. If you suspect a signing key is compromised, revoke it and create a new one; revoking breaks every service that uses it, so switch servers first. [5]

Can cost moneyThe rules say

Membership lapse

If your membership expires you lose access to Certificates, Identifiers & Profiles, so you cannot create or replace keys until you renew. [4]

What you end up with

Env varSecretFormatWhat it is
APNS_KEY_IDnot secretABC123DEFG10-character Key ID of the APNs auth key (JWT kid header).
APNS_TEAM_IDnot secretABCDE1234510-character Apple Developer Team ID (JWT iss claim). Same value as APPLE_TEAM_ID.
APNS_PRIVATE_KEYsecretcontents of AuthKey_<KEY_ID>.p8The .p8 token signing key (PEM text). Secret; never commit or send to clients.

Renewals

  • Provider authentication token (JWT) signed with the key; regenerate between 20 and 60 minutes: every 60 minutes [1]

Pricing

  • Requires an Apple Developer Program membership to create keys. [to verify] Apple states no separate APNs charge on the pages read.

Source [2]

For agents

The same entry as JSON: /api/v1/entries/apple/apns-keys · requirements /api/v1/requirements/apple/apns-keys · terms /api/v1/terms/apple/apns-keys.

Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp

> "What do I need for Apple Push Notification service (APNs) auth key, and how long will it take?"
  → tools/call requirements { "provider_id": "apple/apns-keys" }

Sources

  1. Establishing a token-based connection to APNs Team-scoped keys limited to Sandbox or Production, max two per environment; topic-specific keys max 200 per environment with up to 400 topics each; 10-character Key ID and Team ID; ES256 only; refresh tokens no more than once every 20 minutes and at least every 60 minutes; tokens older than one hour rejected (ExpiredProviderToken); one team per connection; revoke compromised keys; transferred apps need new connections. · accessed 25 October 2026 · official
  2. Create a private key - Keys - Account - Help - Apple Developer Steps to create a key with APNs enabled and choose environment and key type; saved as .p8; cannot be downloaded again; required role Account Holder or Admin. · accessed 25 October 2026 · official
  3. Revoke, edit, and download keys - Keys - Account - Help - Apple Developer A key can be downloaded only once; revoking makes it invalid and affects every service using it; required role Account Holder or Admin. · accessed 25 October 2026 · official
  4. Renewal - Membership - Account - Help - Apple Developer Expired membership loses access to Certificates, Identifiers & Profiles. · accessed 25 October 2026 · official
  5. Apple Developer Program License Agreement You must safeguard authentication credentials (keys, tokens) associated with your developer account and use them only as authorised. · accessed 25 October 2026 · official

Provider rules change. This page is generated from verapli registry version 2026.1025.387; spotted something out of date? Tell us. Apple is not affiliated with verapli.