Apple Push Notifications

🔔 APNs Certificates vs APNs Authentication Key — Which One Should You Choose?

Apple Push Notification service (APNs) enables iOS apps to receive remote notifications from backend servers. Whether you’re sending alerts, messages, or silent updates, APNs is at the core of delivering that content to your app.

But when integrating with APNs, developers have two choices for server-side authentication:

1. APNs Certificates (.pem)
2. APNs Authentication Keys (.p8)

Which should you choose — and why? Let’s compare them, explore how the push flow works, and understand the pros and cons of each approach.

📬 Apple Push Notification Flow — How It Works

At a high level, the push notification flow looks like this:

1. App registers for remote notifications iOS requests a device token from APNs and provides it to the app.
2. App sends the device token to the backend Your server stores this token to send future notifications.
3. Backend sends notification to APNs This is where authentication happens — either via .pem or .p8.
4. APNs delivers the message to the device APNs validates the request, locates the target device, and pushes the notification.

✅ Key Benefits of Using APNs Key

• Single Key for All Apps A single .p8 key can be used across all apps in our Apple Developer account (both Dev and Prod), simplifying setup and eliminating the need to manage multiple certificates.
• No Expiry or Renewals Unlike .pem certificates that expire annually, APNs keys do not expire, reducing the risk of push failures due to expired credentials and avoiding manual renewal effort.
• More Secure with JWT APNs keys use JWT-based authentication, which is more secure and better suited for modern cloud or serverless environments.
• Easier Backend Integration The .p8 method involves generating and sending a signed JWT with each request, making backend integration cleaner and more flexible.
• Lower Maintenance Overhead No need to export, convert, or rotate .pem files across environments. Maintenance is minimal with the .p8 key approach.

📲 How to Configure Push Notifications Using APNs Key and Certificate

Apple offers two authentication mechanisms for sending push notifications:

1. APNs Certificate (.pem) – legacy method using TLS
2. APNs Key (.p8) – modern, JWT-based method

Let’s walk through both methods.

🔑 Method 1: Using APNs Key (.p8) – Recommended

✅ Best for:

• New projects
• Server-less/cloud environments
• Teams managing multiple apps

🛠 Step-by-Step Configuration

Step 1: Enable Push Capability in Xcode

• Open your Xcode project
• Go to Signing & Capabilities
• Add “Push Notifications” capability

Step 2: Register for Push in App

In your AppDelegate or SceneDelegate:

UNUserNotificationCenter.current().requestAuthorization(options: [.alert, .badge, .sound]) { granted, error in
    DispatchQueue.main.async {
        UIApplication.shared.registerForRemoteNotifications()
    }
}

Step 3: Create APNs Key in Apple Developer Portal

1. Go to Apple Developer Account → Certificates, IDs & Profiles → Keys
2. Click “+” to create a new key
3. Check Apple Push Notifications service (APNs)
4. Download the .p8 file (⚠️ only once!)
5. Note the Key ID and your Team ID

Step 4: Backend Configuration

Use the .p8 key to sign a JWT for push authentication.

Sample JWT header:

{
  "alg": "ES256",
  "kid": "YOUR_KEY_ID"
}

Sample JWT payload:

{
  "iss": "YOUR_TEAM_ID",
  "iat": <UNIX_TIMESTAMP>
}

Generate this JWT using your .p8 key and attach it in the Authorization header.

Step 5: Send Push Notification

Make an HTTPS POST request to APNs:

POST https://api.push.apple.com/3/device/<device_token>
Headers:
- Authorization: Bearer <JWT>
- apns-topic: <your-app-bundle-id>

Body:

{
  "aps": {
    "alert": "Hello from .p8!",
    "sound": "default"
  }
}

📜 Method 2: Using APNs Certificate (.pem) – Legacy

✅ Best for:

• Legacy systems
• On-premise server setups
• Simple one-app environments

🛠 Step-by-Step Configuration

Step 1: Enable Push Capability in Xcode

(Same as above)

Step 2: Register for Push in App

(Same as above)

Step 3: Create APNs Certificate

1. Go to Apple Developer Portal → Certificates
2. Click “+” → Apple Push Notification service SSL (Sandbox & Production)
3. Select your App ID
4. Upload CSR (from Keychain or OpenSSL)
5. Download the .cer file

Step 4: Convert .cer to .pem

1. Open Keychain Access → Export .p12 from certificate
2. Use OpenSSL to convert to .pem:

openssl pkcs12 -in pushcert.p12 -out pushcert.pem -nodes -clcerts

You now have a .pem file with both cert and private key.

Step 5: Send Push Notification

Use a library or curl:

curl -v \
--cert ./pushcert.pem \
--key ./privatekey.pem \
--header "apns-topic: com.example.myapp" \
--data '{"aps":{"alert":"Hello from .pem!"}}' \
https://api.push.apple.com/3/device/<device_token>

⚠️ Notes:

• You need separate certificates for Dev and Prod
• Certificates expire yearly
• Must be updated manually on backend servers

✅ Final Thoughts

If you’re starting a new project or migrating existing infrastructure, the APNs Authentication Key (.p8) is the clear winner — it's easier to manage, more secure, and future-proof. While Apple still supports .pemcertificates, the .p8 method is clearly the path forward — offering better scalability, maintainability, and security.

Still using .pem? Unless you have legacy constraints, It’s time to plan a migration.