Enabling Web Push

Web Push is optional — if you don’t configure VAPID keys, the Settings → Notifications page is hidden everywhere in the UI and sign requests only go out via WebSocket toasts.

To turn it on, give the broker a VAPID keypair.

1. Generate VAPID keys

One-off, store the private key safely:

npx web-push generate-vapid-keys

2. Add to config.yaml

vapid:
  subject: "mailto:admin@example.com"
  publicKey: "BEl62iU..."        # base64url-encoded
  privateKey: "UGo..."           # base64url-encoded

Restart the broker. Settings → Notifications is now visible to logged-in users.

3. Have users subscribe

Each user enables push from their own browser via Settings → Notifications. Subscriptions are stored per-account, per-device — multiple devices on one account get parallel deliveries.

See Guides → Web Push notifications for the user-facing side.

Notes

• VAPID keys are environment-specific. Don’t share them between dev and prod, and don’t commit them to a repo.
• Rotating VAPID keys invalidates all existing push subscriptions — users have to re-subscribe.
• Push delivery uses Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM). The broker needs outbound HTTPS to those.