Skip to main content

Apple Token Based (.p8) Push Notifications

How to configure Apple Push Notification service (APNs) using a token-based .p8 Auth Key instead of a .p12 certificate.

Written by Jason Liang

We now support Apple's token-based (.p8) signing keys as an alternative to .p12 certificates for Apple Push Notification service (APNs). The advantage: a token-based key never expires, unlike a .p12 certificate which must be renewed every 12 months -- and the same key can be reused across every app registered under your Apple Developer team.

To switch to Token Based push notification settings

  • Navigate to App > Design > Notifications > Settings.

  • If the app is Live, you'll see an "App is Live & Locked" banner -- flip the LOCKED / UNLOCKED switch and confirm (you'll need to type the app name) to unlock it for editing.

  • In the Notification Settings table, select the Apple row and click [View...].

  • Click [Edit].

  • Under Authentication Type, select Token Based (.p8).

  • Fill in the fields that appear:

    • Key ID: the 10-character Key ID for your Auth Key, from Apple Developer > Certificates, Identifiers & Profiles > Keys.

    • Team ID: your Apple Developer Team ID, found under Membership in the Apple Developer portal.

    • PKS8 PEM Data: open the .p8 file Apple gave you in a text editor and paste its full contents -- including the -----BEGIN PRIVATE KEY----- / -----END PRIVATE KEY----- lines -- into this field. This is a paste-in field, not a file upload.

    • App ID: your iOS app's Bundle ID. This is used as the push notification topic.

  • Check Push Notification Environment (Development / Production) -- this setting is shared by both authentication types, so make sure it still matches where you want to send pushes.

  • Hit [Save].

Good to know

  • Apple only lets you download a given .p8 key once. Store it somewhere safe -- if you lose it, you'll need to revoke the key in the Apple Developer portal, generate a new one, and re-enter Key ID / Team ID / PEM data here.

  • One Auth Key works for every app under the same Apple Developer team -- you don't need a separate .p8 per app, unlike certificates.

  • Saving only checks that all four fields are filled in -- it doesn't verify the PEM content or that Key ID/Team ID actually match. If something's off, the error won't surface until you send a push. Double check each value before saving.

  • Certificate Based (.p12) is still available if you need it -- the same Authentication Type selector lets you switch back at any time. See Push Notification Configuration - iOS for certificate-based setup.

Related Articles
Did this answer your question?