Definition

VAPID

Short definition

VAPID (Voluntary Application Server Identification) is a key-pair scheme, standardised in RFC 8292, where a server generates one ECDSA P-256 key pair, keeps the private key secret, and shares the public key with browsers via the applicationServerKey option when subscribing. It lets push services verify which application server is sending a given message without requiring a proprietary developer account per browser vendor.

Reviewed August 2, 2026

A typical Node setup uses the web-push library: const vapidKeys = webpush.generateVAPIDKeys(); webpush.setVapidDetails("mailto:ops@example.com", vapidKeys.publicKey, vapidKeys.privateKey);. The mailto contact is required by the spec so push services can reach an application owner about abuse.

The same key pair should be reused for the lifetime of your subscriptions — rotating VAPID keys invalidates every existing subscription created with the old public key, forcing all users to resubscribe.

VAPID replaced earlier vendor-specific mechanisms like Chrome's original sender-ID requirement, letting any server push to any supporting browser with the same standard credentials rather than juggling per-vendor API keys.

The full JWT-based authentication scheme is defined in RFC 8292: https://www.rfc-editor.org/rfc/rfc8292.

Related terms

Push API

The Push API lets a service worker subscribe to a browser-run push service and receive encrypted messages from a server at any time, including when no tab or window for the site is open. Subscribing is done with registration.pushManager.subscribe({ userVisibleOnly: true, applicationServerKey }), and incoming messages arrive in the worker's push event.

PushSubscription

A PushSubscription is the object returned by pushManager.subscribe(), containing an endpoint (a unique, vendor-hosted URL that identifies this specific device/browser installation) and a keys object with p256dh and auth values used to encrypt messages sent to it. Your server stores this per user and sends future notifications by POSTing an encrypted payload to subscription.endpoint.

Web push

Web push is a W3C standard that lets a website deliver push notifications to a user's device via the browser's push service, even when the site is closed. Delivery requires a service worker and explicit user permission.

push event (service worker)

The push event fires on the service worker whenever a message arrives from the push service the browser is subscribed to. A handler typically reads event.data.json() for the payload and calls event.waitUntil(self.registration.showNotification(title, options)) so the browser keeps the worker alive until the notification is actually displayed.

badge (Notification option)

badge is a field passed to showNotification(title, { badge: "/badge-72.png", ... }) that supplies a small, typically monochrome PNG icon (recommended around 72x72 or 96x96) shown in the Android status bar and shade, as distinct from the larger icon field used for the main notification image.

actions (Notification option)

actions is an array option passed to showNotification(), e.g. { actions: [{ action: "reply", title: "Reply" }, { action: "dismiss", title: "Dismiss" }] }, that renders extra buttons on the notification itself. The service worker's notificationclick handler reads event.action to see which button, if any, the user pressed.