HOW IT WORKS
1. Start with HTTPS and a service worker
A browser needs a secure origin and service worker to handle push events. Your site requests permission in a user-centered flow and cannot assume permission will be granted.
2. Create a subscription
PushManager.subscribe produces an endpoint and cryptographic keys. Your server stores the subscription securely and associates it with the appropriate app and user.
3. Use VAPID for application identification
VAPID application server keys identify the sending application to push services. They are separate from payload-encryption keys and should be managed carefully.
4. Handle failure honestly
A push service may accept a message without a visible notification. Offline status, TTL, permissions and browser policies affect outcomes. Report subscription expiration and provider responses.