{"id":3207,"date":"2026-11-01T21:20:36","date_gmt":"2026-11-01T15:50:36","guid":{"rendered":"https:\/\/larapush.com\/blog\/?p=3207"},"modified":"2026-11-01T21:20:36","modified_gmt":"2026-11-01T15:50:36","slug":"vapid-keys-web-push","status":"publish","type":"post","link":"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/","title":{"rendered":"What Are VAPID Keys and Do You Need Them for Web Push?"},"content":{"rendered":"\n<p><strong>VAPID keys are a public and private key pair that identifies your server to browser push services. You pass the public key when a visitor subscribes, then sign every push message with the private key. Yes, you need them: Chrome and Edge require one for web push, and messages signed with the wrong key are rejected.<\/strong><\/p>\n\n\n\n<p>VAPID keys sound obscure, but they decide something important: who can send notifications to your subscribers. As a tech geek, I like this part of web push because it explains a lot of &#8220;why can&#8217;t I just move my subscribers?&#8221; questions. In this post I cover what VAPID keys are, how they work, how to create them, and why owning them matters. The technical details come from <a href=\"https:\/\/www.rfc-editor.org\/rfc\/rfc8292\" target=\"_blank\" rel=\"noreferrer noopener\">RFC 8292<\/a>, the IETF standard that defines VAPID, and <a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/API\/PushManager\/subscribe\" target=\"_blank\" rel=\"noreferrer noopener\">MDN&#8217;s PushManager docs<\/a>.<\/p>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_63 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title \" >Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#What_are_VAPID_keys_in_web_push\" title=\"What are VAPID keys in web push?\">What are VAPID keys in web push?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#How_do_VAPID_keys_work\" title=\"How do VAPID keys work?\">How do VAPID keys work?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#Do_you_need_VAPID_keys_for_web_push\" title=\"Do you need VAPID keys for web push?\">Do you need VAPID keys for web push?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#Are_VAPID_keys_the_same_as_the_encryption_keys\" title=\"Are VAPID keys the same as the encryption keys?\">Are VAPID keys the same as the encryption keys?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#How_do_you_generate_VAPID_keys\" title=\"How do you generate VAPID keys?\">How do you generate VAPID keys?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#What_happens_if_you_change_or_lose_your_VAPID_keys\" title=\"What happens if you change or lose your VAPID keys?\">What happens if you change or lose your VAPID keys?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#Who_owns_your_VAPID_keys_when_you_use_a_push_service\" title=\"Who owns your VAPID keys when you use a push service?\">Who owns your VAPID keys when you use a push service?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#Where_does_LaraPush_fit\" title=\"Where does LaraPush fit?\">Where does LaraPush fit?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#Frequently_asked_questions\" title=\"Frequently asked questions\">Frequently asked questions<\/a><\/li><\/ul><\/nav><\/div>\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_are_VAPID_keys_in_web_push\"><\/span>What are VAPID keys in web push?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>VAPID keys are an ECDSA key pair on the P-256 curve used by the Voluntary Application Server Identification (VAPID) standard. VAPID lets your application server prove its identity to a push service, such as Firebase Cloud Messaging (FCM) for Chrome or Mozilla&#8217;s push service for Firefox.<\/p>\n\n\n\n<p>The pair has two halves with very different jobs:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Key<\/th><th>Where it lives<\/th><th>What it does<\/th><\/tr><\/thead><tbody><tr><td>Public key<\/td><td>In your website&#8217;s JavaScript, given to the browser at subscribe time<\/td><td>Ties each new push subscription to your server<\/td><\/tr><tr><td>Private key<\/td><td>Only on your sending server, kept secret<\/td><td>Signs a short-lived token on every push message<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>In plain terms, the public key is like a lock you hand out, and the private key is the only key that opens it.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_do_VAPID_keys_work\"><\/span>How do VAPID keys work?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>VAPID keys work in two steps: binding a subscription to your public key, then proving you hold the matching private key on every send.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Subscribe<\/strong>: your page calls the Push API&#8217;s PushManager.subscribe() with your public key as applicationServerKey. The browser creates a push subscription restricted to that key.<\/li>\n\n\n\n<li><strong>Store<\/strong>: your server saves the subscription, which includes the push service endpoint URL and encryption keys.<\/li>\n\n\n\n<li><strong>Sign<\/strong>: when you send, your server creates a JSON Web Token (JWT) signed with the private key, using the ES256 algorithm.<\/li>\n\n\n\n<li><strong>Send<\/strong>: the request goes to the push service with an Authorization header using the &#8220;vapid&#8221; scheme, containing the token and your public key.<\/li>\n\n\n\n<li><strong>Verify<\/strong>: the push service checks the signature against the public key used at subscribe time. If it matches, the message is delivered.<\/li>\n<\/ol>\n\n\n\n<p>RFC 8292 sets a few rules for that token. Its &#8220;exp&#8221; (expiry) claim can&#8217;t be more than 24 hours in the future. Its &#8220;aud&#8221; (audience) claim must match the push service&#8217;s origin. And it may include a &#8220;sub&#8221; claim with a mailto: or https: contact, so the push service can reach you if something goes wrong.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Do_you_need_VAPID_keys_for_web_push\"><\/span>Do you need VAPID keys for web push?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>Yes, for any modern web push setup you need VAPID keys. MDN notes that applicationServerKey is required in some browsers, including Chrome and Edge. Without it, the subscribe call fails there.<\/p>\n\n\n\n<p>Safari follows the same standards. In its <a href=\"https:\/\/webkit.org\/blog\/12945\/meet-web-push\/\" target=\"_blank\" rel=\"noreferrer noopener\">Meet Web Push<\/a> post, WebKit says sites coded to the standards can reach Safari users, and you don&#8217;t need to join the Apple Developer Program to send web push. On iPhone and iPad, web push also needs iOS 16.4 or later and the site added to the Home Screen.<\/p>\n\n\n\n<p>However, if you use a push service such as OneSignal or a self-hosted panel, it usually generates and manages the keys for you. You still have VAPID keys; you just don&#8217;t see them.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Are_VAPID_keys_the_same_as_the_encryption_keys\"><\/span>Are VAPID keys the same as the encryption keys?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>No. VAPID keys authenticate your server, while separate keys encrypt the message content. MDN states plainly that the applicationServerKey &#8220;IS NOT the same ECDH key that you use to encrypt the data.&#8221;<\/p>\n\n\n\n<p>Each push subscription comes with its own encryption keys, called p256dh and auth, created by the browser. Your server uses those to encrypt the payload so the push service can&#8217;t read it. So a complete send uses both: the subscription&#8217;s keys for encryption, and your VAPID private key for the signature.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_do_you_generate_VAPID_keys\"><\/span>How do you generate VAPID keys?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>You generate VAPID keys once, with a library or a console, and then keep them for the life of your subscriber list. Here are three common ways:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Method<\/th><th>How<\/th><th>Best for<\/th><\/tr><\/thead><tbody><tr><td>Node.js web-push library<\/td><td>Run the generate-vapid-keys command of <a href=\"https:\/\/github.com\/web-push-libs\/web-push\" target=\"_blank\" rel=\"noreferrer noopener\">web-push<\/a><\/td><td>Developers building their own sender<\/td><\/tr><tr><td>Firebase console<\/td><td>Settings > General, Cloud Messaging tab, Web Push certificates, Generate Key Pair<\/td><td>Sites sending through FCM<\/td><\/tr><tr><td>Push platform or panel<\/td><td>Created automatically when you add a site<\/td><td>Most site owners<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>The <a href=\"https:\/\/firebase.google.com\/docs\/cloud-messaging\/js\/client\" target=\"_blank\" rel=\"noreferrer noopener\">Firebase web client guide<\/a> also lets you import an existing key pair instead of generating a new one. That&#8217;s useful when you move a project and want to keep existing subscriptions working.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_happens_if_you_change_or_lose_your_VAPID_keys\"><\/span>What happens if you change or lose your VAPID keys?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>If you change or lose your VAPID private key, you can&#8217;t send to existing subscribers anymore. RFC 8292 says a push service must reject messages to a restricted subscription when the key used to sign doesn&#8217;t match the one used at subscribe time. Rejections typically come back as 401 or 403 errors.<\/p>\n\n\n\n<p>The standard is explicit about rotation. A server that replaces its signing key needs the browser to create a new subscription restricted to the new key. In practice, that means each subscriber&#8217;s browser has to resubscribe, usually silently on their next visit if notification permission is still granted.<\/p>\n\n\n\n<p>So treat the private key like a database password:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Back it up<\/strong>: store it with your other server secrets.<\/li>\n\n\n\n<li><strong>Don&#8217;t rotate casually<\/strong>: changing it effectively restarts subscriptions.<\/li>\n\n\n\n<li><strong>Keep it private<\/strong>: anyone with it, plus your subscription list, can send as you.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Who_owns_your_VAPID_keys_when_you_use_a_push_service\"><\/span>Who owns your VAPID keys when you use a push service?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>With a hosted push service, the provider usually creates and holds the private key, not you. That&#8217;s convenient, but it&#8217;s also why moving providers is hard. Your subscriptions are bound to a key you may not be able to export.<\/p>\n\n\n\n<p>That&#8217;s why I always check key ownership before choosing a tool. If you control the keys, you control your list. I explain the practical side of this in <a href=\"https:\/\/larapush.com\/blog\/push-provider-shutdown-subscribers\/\">what happens to your subscribers when a push provider shuts down<\/a>. For background on the whole delivery chain, see <a href=\"https:\/\/larapush.com\/blog\/how-do-push-notifications-work\/\">how push notifications work<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Where_does_LaraPush_fit\"><\/span>Where does LaraPush fit?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>LaraPush is a self-hosted web push panel, so it runs on your own VPS with your own Firebase configuration. Setup involves adding your site and its Firebase config in the panel, as described in the <a href=\"https:\/\/larapush.com\/guide\/\">LaraPush guide<\/a>. The panel stores subscribers on your server, and delivery goes through FCM.<\/p>\n\n\n\n<p>The trade-off is responsibility. You keep the server, backups and credentials safe, and the licence covers one server. Pricing starts from $499 one-time; see <a href=\"https:\/\/larapush.com\/pricing\/\">LaraPush pricing<\/a>. If you&#8217;d rather build everything yourself with open-source libraries, I compare that route in <a href=\"https:\/\/larapush.com\/blog\/open-source-vs-paid-self-hosted-push\/\">open-source vs paid self-hosted push<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Frequently_asked_questions\"><\/span>Frequently asked questions<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<div class=\"schema-faq wp-block-yoast-faq-block\"><div class=\"schema-faq-section\" id=\"faq-question-1762030000000\"><strong class=\"schema-faq-question\">What are VAPID keys?<\/strong> <p class=\"schema-faq-answer\">VAPID keys are a public and private ECDSA P-256 key pair defined by RFC 8292. The public key goes to the browser when a visitor subscribes, and the private key signs each push message on your server. Push services use them to check that messages come from the server the subscriber signed up with.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1762030001111\"><strong class=\"schema-faq-question\">Is the VAPID public key safe to expose?<\/strong> <p class=\"schema-faq-answer\">Yes. The public key is meant to be shared and sits in your site&#8217;s JavaScript. The private key is the one to protect. Keep it only on your sending server, because anyone with the private key and your subscription list could send notifications as you.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1762030002222\"><strong class=\"schema-faq-question\">Can I change my VAPID keys without losing subscribers?<\/strong> <p class=\"schema-faq-answer\">Not directly. RFC 8292 says subscriptions are restricted to the key used when they were created, and a server that replaces its key must request new subscriptions. Browsers that still grant permission can usually resubscribe silently on the next visit, but people who don&#8217;t return are lost.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1762030003333\"><strong class=\"schema-faq-question\">Do I need VAPID keys for Safari web push?<\/strong> <p class=\"schema-faq-answer\">Safari uses the standard Push API, so the usual VAPID-based flow applies. WebKit says you don&#8217;t need to join the Apple Developer Program to send web push to Safari. On iPhone and iPad, users need iOS 16.4 or later and must add the site to the Home Screen.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1762030004444\"><strong class=\"schema-faq-question\">How long is a VAPID token valid?<\/strong> <p class=\"schema-faq-answer\">The signed token, a JWT, must have an expiry no more than 24 hours after the time of the request, according to RFC 8292. Push libraries create a fresh token for you when sending. The key pair itself doesn&#8217;t expire and should be kept for the life of your list.<\/p> <\/div><\/div>\n","protected":false},"excerpt":{"rendered":"What VAPID keys are, how they sign web push messages, how to generate them, and why losing or changing them cuts off your subscribers.","protected":false},"author":7,"featured_media":3215,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","csco_display_header_overlay":false,"csco_singular_sidebar":"","csco_page_header_type":""},"categories":[63],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.2 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>What Are VAPID Keys and Do You Need Them for Web Push?<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What Are VAPID Keys and Do You Need Them for Web Push?\" \/>\n<meta property=\"og:description\" content=\"What VAPID keys are, how they sign web push messages, how to generate them, and why losing or changing them cuts off your subscribers.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/\" \/>\n<meta property=\"og:site_name\" content=\"LaraPush Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-01T15:50:36+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/larapush.com\/blog\/wp-content\/uploads\/2026\/11\/vapid-keys-web-push.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"675\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Ritesh Das\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ritesh Das\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/\"},\"author\":{\"name\":\"Ritesh Das\",\"@id\":\"https:\/\/larapush.com\/blog\/#\/schema\/person\/4f23894f98426ea3a6bd617e59f03bbd\"},\"headline\":\"What Are VAPID Keys and Do You Need Them for Web Push?\",\"datePublished\":\"2026-11-01T15:50:36+00:00\",\"dateModified\":\"2026-11-01T15:50:36+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/\"},\"wordCount\":1453,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/larapush.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/larapush.com\/blog\/wp-content\/uploads\/2026\/11\/vapid-keys-web-push.jpg\",\"articleSection\":[\"Guides\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#respond\"]}]},{\"@type\":[\"WebPage\",\"FAQPage\"],\"@id\":\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/\",\"url\":\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/\",\"name\":\"What Are VAPID Keys and Do You Need Them for Web Push?\",\"isPartOf\":{\"@id\":\"https:\/\/larapush.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/larapush.com\/blog\/wp-content\/uploads\/2026\/11\/vapid-keys-web-push.jpg\",\"datePublished\":\"2026-11-01T15:50:36+00:00\",\"dateModified\":\"2026-11-01T15:50:36+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#breadcrumb\"},\"mainEntity\":[{\"@id\":\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030000000\"},{\"@id\":\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030001111\"},{\"@id\":\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030002222\"},{\"@id\":\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030003333\"},{\"@id\":\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030004444\"}],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#primaryimage\",\"url\":\"https:\/\/larapush.com\/blog\/wp-content\/uploads\/2026\/11\/vapid-keys-web-push.jpg\",\"contentUrl\":\"https:\/\/larapush.com\/blog\/wp-content\/uploads\/2026\/11\/vapid-keys-web-push.jpg\",\"width\":1200,\"height\":675,\"caption\":\"Illustration of VAPID keys, a public and private key pair signing a web push message\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/larapush.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"What Are VAPID Keys and Do You Need Them for Web Push?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/larapush.com\/blog\/#website\",\"url\":\"https:\/\/larapush.com\/blog\/\",\"name\":\"LaraPush Blog\",\"description\":\"Stay Ahead, Stay Notified with LaraPush!\",\"publisher\":{\"@id\":\"https:\/\/larapush.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/larapush.com\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/larapush.com\/blog\/#organization\",\"name\":\"LaraPush\",\"url\":\"https:\/\/larapush.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/larapush.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/larapush.com\/blog\/wp-content\/uploads\/2022\/05\/LARAPUSH.png\",\"contentUrl\":\"https:\/\/larapush.com\/blog\/wp-content\/uploads\/2022\/05\/LARAPUSH.png\",\"width\":280,\"height\":60,\"caption\":\"LaraPush\"},\"image\":{\"@id\":\"https:\/\/larapush.com\/blog\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/larapush.com\/blog\/#\/schema\/person\/4f23894f98426ea3a6bd617e59f03bbd\",\"name\":\"Ritesh Das\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/larapush.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/1bd7bb0ba68e36b218587b72e89e511f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/1bd7bb0ba68e36b218587b72e89e511f?s=96&d=mm&r=g\",\"caption\":\"Ritesh Das\"},\"url\":\"https:\/\/larapush.com\/blog\/author\/riteshdas\/\"},{\"@type\":\"Question\",\"@id\":\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030000000\",\"position\":1,\"url\":\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030000000\",\"name\":\"What are VAPID keys?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"VAPID keys are a public and private ECDSA P-256 key pair defined by RFC 8292. The public key goes to the browser when a visitor subscribes, and the private key signs each push message on your server. Push services use them to check that messages come from the server the subscriber signed up with.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030001111\",\"position\":2,\"url\":\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030001111\",\"name\":\"Is the VAPID public key safe to expose?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Yes. The public key is meant to be shared and sits in your site's JavaScript. The private key is the one to protect. Keep it only on your sending server, because anyone with the private key and your subscription list could send notifications as you.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030002222\",\"position\":3,\"url\":\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030002222\",\"name\":\"Can I change my VAPID keys without losing subscribers?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Not directly. RFC 8292 says subscriptions are restricted to the key used when they were created, and a server that replaces its key must request new subscriptions. Browsers that still grant permission can usually resubscribe silently on the next visit, but people who don't return are lost.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030003333\",\"position\":4,\"url\":\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030003333\",\"name\":\"Do I need VAPID keys for Safari web push?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Safari uses the standard Push API, so the usual VAPID-based flow applies. WebKit says you don't need to join the Apple Developer Program to send web push to Safari. On iPhone and iPad, users need iOS 16.4 or later and must add the site to the Home Screen.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030004444\",\"position\":5,\"url\":\"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030004444\",\"name\":\"How long is a VAPID token valid?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"The signed token, a JWT, must have an expiry no more than 24 hours after the time of the request, according to RFC 8292. Push libraries create a fresh token for you when sending. The key pair itself doesn't expire and should be kept for the life of your list.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"What Are VAPID Keys and Do You Need Them for Web Push?","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/","og_locale":"en_US","og_type":"article","og_title":"What Are VAPID Keys and Do You Need Them for Web Push?","og_description":"What VAPID keys are, how they sign web push messages, how to generate them, and why losing or changing them cuts off your subscribers.","og_url":"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/","og_site_name":"LaraPush Blog","article_published_time":"2026-11-01T15:50:36+00:00","og_image":[{"width":1200,"height":675,"url":"https:\/\/larapush.com\/blog\/wp-content\/uploads\/2026\/11\/vapid-keys-web-push.jpg","type":"image\/jpeg"}],"author":"Ritesh Das","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Ritesh Das","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#article","isPartOf":{"@id":"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/"},"author":{"name":"Ritesh Das","@id":"https:\/\/larapush.com\/blog\/#\/schema\/person\/4f23894f98426ea3a6bd617e59f03bbd"},"headline":"What Are VAPID Keys and Do You Need Them for Web Push?","datePublished":"2026-11-01T15:50:36+00:00","dateModified":"2026-11-01T15:50:36+00:00","mainEntityOfPage":{"@id":"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/"},"wordCount":1453,"commentCount":0,"publisher":{"@id":"https:\/\/larapush.com\/blog\/#organization"},"image":{"@id":"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#primaryimage"},"thumbnailUrl":"https:\/\/larapush.com\/blog\/wp-content\/uploads\/2026\/11\/vapid-keys-web-push.jpg","articleSection":["Guides"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#respond"]}]},{"@type":["WebPage","FAQPage"],"@id":"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/","url":"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/","name":"What Are VAPID Keys and Do You Need Them for Web Push?","isPartOf":{"@id":"https:\/\/larapush.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#primaryimage"},"image":{"@id":"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#primaryimage"},"thumbnailUrl":"https:\/\/larapush.com\/blog\/wp-content\/uploads\/2026\/11\/vapid-keys-web-push.jpg","datePublished":"2026-11-01T15:50:36+00:00","dateModified":"2026-11-01T15:50:36+00:00","breadcrumb":{"@id":"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#breadcrumb"},"mainEntity":[{"@id":"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030000000"},{"@id":"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030001111"},{"@id":"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030002222"},{"@id":"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030003333"},{"@id":"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030004444"}],"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/larapush.com\/blog\/vapid-keys-web-push\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#primaryimage","url":"https:\/\/larapush.com\/blog\/wp-content\/uploads\/2026\/11\/vapid-keys-web-push.jpg","contentUrl":"https:\/\/larapush.com\/blog\/wp-content\/uploads\/2026\/11\/vapid-keys-web-push.jpg","width":1200,"height":675,"caption":"Illustration of VAPID keys, a public and private key pair signing a web push message"},{"@type":"BreadcrumbList","@id":"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/larapush.com\/blog\/"},{"@type":"ListItem","position":2,"name":"What Are VAPID Keys and Do You Need Them for Web Push?"}]},{"@type":"WebSite","@id":"https:\/\/larapush.com\/blog\/#website","url":"https:\/\/larapush.com\/blog\/","name":"LaraPush Blog","description":"Stay Ahead, Stay Notified with LaraPush!","publisher":{"@id":"https:\/\/larapush.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/larapush.com\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/larapush.com\/blog\/#organization","name":"LaraPush","url":"https:\/\/larapush.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/larapush.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/larapush.com\/blog\/wp-content\/uploads\/2022\/05\/LARAPUSH.png","contentUrl":"https:\/\/larapush.com\/blog\/wp-content\/uploads\/2022\/05\/LARAPUSH.png","width":280,"height":60,"caption":"LaraPush"},"image":{"@id":"https:\/\/larapush.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/larapush.com\/blog\/#\/schema\/person\/4f23894f98426ea3a6bd617e59f03bbd","name":"Ritesh Das","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/larapush.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/1bd7bb0ba68e36b218587b72e89e511f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/1bd7bb0ba68e36b218587b72e89e511f?s=96&d=mm&r=g","caption":"Ritesh Das"},"url":"https:\/\/larapush.com\/blog\/author\/riteshdas\/"},{"@type":"Question","@id":"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030000000","position":1,"url":"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030000000","name":"What are VAPID keys?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"VAPID keys are a public and private ECDSA P-256 key pair defined by RFC 8292. The public key goes to the browser when a visitor subscribes, and the private key signs each push message on your server. Push services use them to check that messages come from the server the subscriber signed up with.","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030001111","position":2,"url":"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030001111","name":"Is the VAPID public key safe to expose?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"Yes. The public key is meant to be shared and sits in your site's JavaScript. The private key is the one to protect. Keep it only on your sending server, because anyone with the private key and your subscription list could send notifications as you.","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030002222","position":3,"url":"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030002222","name":"Can I change my VAPID keys without losing subscribers?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"Not directly. RFC 8292 says subscriptions are restricted to the key used when they were created, and a server that replaces its key must request new subscriptions. Browsers that still grant permission can usually resubscribe silently on the next visit, but people who don't return are lost.","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030003333","position":4,"url":"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030003333","name":"Do I need VAPID keys for Safari web push?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"Safari uses the standard Push API, so the usual VAPID-based flow applies. WebKit says you don't need to join the Apple Developer Program to send web push to Safari. On iPhone and iPad, users need iOS 16.4 or later and must add the site to the Home Screen.","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030004444","position":5,"url":"https:\/\/larapush.com\/blog\/vapid-keys-web-push\/#faq-question-1762030004444","name":"How long is a VAPID token valid?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"The signed token, a JWT, must have an expiry no more than 24 hours after the time of the request, according to RFC 8292. Push libraries create a fresh token for you when sending. The key pair itself doesn't expire and should be kept for the life of your list.","inLanguage":"en-US"},"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/larapush.com\/blog\/wp-json\/wp\/v2\/posts\/3207"}],"collection":[{"href":"https:\/\/larapush.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/larapush.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/larapush.com\/blog\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/larapush.com\/blog\/wp-json\/wp\/v2\/comments?post=3207"}],"version-history":[{"count":1,"href":"https:\/\/larapush.com\/blog\/wp-json\/wp\/v2\/posts\/3207\/revisions"}],"predecessor-version":[{"id":3216,"href":"https:\/\/larapush.com\/blog\/wp-json\/wp\/v2\/posts\/3207\/revisions\/3216"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/larapush.com\/blog\/wp-json\/wp\/v2\/media\/3215"}],"wp:attachment":[{"href":"https:\/\/larapush.com\/blog\/wp-json\/wp\/v2\/media?parent=3207"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/larapush.com\/blog\/wp-json\/wp\/v2\/categories?post=3207"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/larapush.com\/blog\/wp-json\/wp\/v2\/tags?post=3207"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}