T
testing
API Reference: Integrations & Infrastructure Retrieving VAPID Keys

To send secure web push notifications to your users, you need to authenticate your application using VAPID (Voluntary Application Server Identification) keys. Use this endpoint to retrieve your project's VAPID public key, which is required when subscribing a client to push notifications.

Web Push Notifications

The VAPID public key retrieved here is used alongside the Events API to trigger and manage notifications across your projects.

Endpoint details

MethodEndpointDescription
GET/v1/event/vapid-public-keyRetrieves the VAPID public key for the authenticated environment.

Why only the public key?
Your VAPID private key is securely managed by our infrastructure to sign outgoing push messages. You only need the public key on your client-side application to create the initial push subscription.

Retrieving the key

Make a GET request to the endpoint to fetch your public key. Ensure you include your standard API authentication token in the headers.

Request example

curl -X GET "https://api.yourdomain.com/v1/event/vapid-public-key" 
  -H "Authorization: Bearer YOUR_API_KEY"

Response example

A successful request returns a 200 OK status with the base64 URL-safe public key.

{
  "public_key": "BEl62iUYgUivxIkv69yViEuiBIa-Ib9-SkvMeAtA3LFgDzkrxZJjSgSnfckjBJuBtc3sANYcjsnMUzchDcO1ubi"
}

How to use the VAPID key

Once you retrieve the public key, you will use it in your frontend application to subscribe users to push notifications.

sequenceDiagram
    participant Client as Frontend App
    participant API as Your API
    participant Browser as Browser Push Manager
    
    Client->>API: GET /v1/event/vapid-public-key
    API-->>Client: Returns { public_key }
    Client->>Browser: pushManager.subscribe({ applicationServerKey: public_key })
    Browser-->>Client: Returns PushSubscription
    Client->>API: Save PushSubscription for user
  1. 1

    Fetch the key

    Call the /v1/event/vapid-public-key endpoint when your application initializes or when the user opts into notifications.

  2. 2

    Convert the key format

    Most browsers require the base64 URL-safe string to be converted into a Uint8Array before passing it to the Push Manager.

  3. 3

    Subscribe the user

    Pass the converted key as the applicationServerKey parameter in your service worker's pushManager.subscribe() method.

Do not hardcode the VAPID public key in your frontend source code if you plan on rotating keys in the future. Always fetch it dynamically from this endpoint.

Frequently asked questions

What is VAPID?

VAPID stands for Voluntary Application Server Identification. It is a cryptographic standard used to restrict who can send push messages to a user's browser. It ensures that only your server (which holds the private key) can send messages to the subscriptions generated by your public key.

Do I need to pass a Project ID?

No. The /v1/event/vapid-public-key endpoint automatically resolves the correct VAPID key based on the API token or environment credentials provided in your request headers.