VAPID
VAPID (Voluntary Application Server Identification) is a standard where the server sending a web push signs it with a private key, and the recipient's browser checks it against a public key. In plain terms, it's how a browser confirms a push really came from the service the user subscribed to, not from an impersonator.
Why VAPID matters for push
Without VAPID identification, browsers (Chrome especially) can throttle or block push notifications from an unrecognized sender, which protects users from spoofed or anonymous senders. VAPID keys also let the browser group all pushes from one service into a single channel and apply its own limits and stats to it.
Who manages VAPID keys in a PWA
Technically, VAPID keys belong to the server sending the push and are usually generated once per domain or project. In PWA affiliate work, that's handled by the platform's infrastructure, not by the buyer manually — APEX's push engine takes over VAPID key management, so setting up campaigns comes down to segments and scenarios, not cryptography.
FAQ
- Does a buyer need to generate VAPID keys themselves?
- Usually not — if the PWA platform (like APEX) already ships a push engine, the keys are generated and maintained automatically on its side.
- What happens if a VAPID key changes on a live project?
- Browsers may stop trusting old subscriptions issued under the previous key, so part of the subscriber base may need to be rebuilt — that's why keys are only rotated when truly necessary.
Cloaking, anti-bot, push, split tests and your own domains — in one service.
Get started free