topic
Verified 2026-09-18VAPID Web Push Authentication
VAPID authenticates an application server to a Web Push service using a signed JWT and an application public key.
Use a short-lived VAPID JWT with the correct audience and subject contact, and keep the signing key private. VAPID identifies the sender; it does not authorize arbitrary push subscriptions.
httpauthsecuritypushauthentication
Reference (http)
Authorization: vapid t=eyJ..., k=BASE64URL_PUBLIC_KEY
Use a short-lived VAPID JWT with the correct audience and subject contact, and keep the signing key private. VAPID identifies the sender; it does not authorize arbitrary push subscriptions.
Common mistakes
- Using the wrong push-service audience, allowing a long-lived JWT, or treating VAPID as proof that a subscription belongs to the caller.