Web Push Tester & VAPID Key Generator

Generate VAPID keys and send Web Push notifications to browser subscriptions with RFC 8291 payload encryption, TTL, urgency and topic.

Result

Press “Run” to see the result.

Call with no parameters (or action=generate_keys) to get a fresh P-256 VAPID key pair in base64url: public_key is the applicationServerKey for pushManager.subscribe() in the browser, private_key stays on your server. Keys are generated for the response only and never stored or logged.

action=send posts a notification to one subscription (the PushSubscription JSON from the browser: endpoint + keys.p256dh + keys.auth) or up to 50 subscriptions. The optional payload (text or JSON, max 4,078 bytes) is encrypted with aes128gcm (RFC 8291) using WebCrypto ECDH, HKDF and AES-GCM, and the request is signed with a VAPID ES256 JWT (RFC 8292) built from your vapid object (subject = mailto: or https: contact, public_key, private_key). Set ttl (seconds, default 86400), urgency (very-low, low, normal, high) and topic (replaces an undelivered message with the same topic).

Each result has the push service HTTP status; gone: true (404 / 410) means the subscription expired and should be deleted. action=encrypt returns the encrypted body and headers without sending, for debugging or sending yourself. Nothing is stored: subscriptions and keys live only in the request.

Use this in your code

curl -X POST "https://apibox.io.vn/v1/web-push" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"action":"send","subscription":{"endpoint":"https://fcm.googleapis.com/fcm/send/abc","keys":{"p256dh":"BCVxsr7N_eNgVRqvHtD0zTZsEc6-VV-JvLexhqUzORcxaOzi6-AYWXvTBHm4bjyPjs7Vd8pZGH6SRpkNtoIAiw4","auth":"BTBZMqHH6r4Tts7J_aSIgg"}},"payload":{"title":"Đơn hàng #1024","body":"Đã giao thành công"},"ttl":3600,"urgency":"high","vapid":{"subject":"mailto:ops@example.com","public_key":"BECWGWmqQ8K_C-FP8oHoC2GdtyNmQRTEHe8z3qsK5VDKHjkpMUG-RRrKyy-jczLPSqC1y15k6r_iPaGLt39VFOw","private_key":"(your private key)"}}'

const res = await fetch('https://apibox.io.vn/v1/web-push', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer YOUR_API_KEY',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "action": "send",
    "subscription": {
      "endpoint": "https://fcm.googleapis.com/fcm/send/abc",
      "keys": {
        "p256dh": "BCVxsr7N_eNgVRqvHtD0zTZsEc6-VV-JvLexhqUzORcxaOzi6-AYWXvTBHm4bjyPjs7Vd8pZGH6SRpkNtoIAiw4",
        "auth": "BTBZMqHH6r4Tts7J_aSIgg"
      }
    },
    "payload": {
      "title": "Đơn hàng #1024",
      "body": "Đã giao thành công"
    },
    "ttl": 3600,
    "urgency": "high",
    "vapid": {
      "subject": "mailto:ops@example.com",
      "public_key": "BECWGWmqQ8K_C-FP8oHoC2GdtyNmQRTEHe8z3qsK5VDKHjkpMUG-RRrKyy-jczLPSqC1y15k6r_iPaGLt39VFOw",
      "private_key": "(your private key)"
    }
  }),
});
const data = await res.json();
console.log(data);

import requests

res = requests.post(
    "https://apibox.io.vn/v1/web-push",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"action": "send", "subscription": {"endpoint": "https://fcm.googleapis.com/fcm/send/abc", "keys": {"p256dh": "BCVxsr7N_eNgVRqvHtD0zTZsEc6-VV-JvLexhqUzORcxaOzi6-AYWXvTBHm4bjyPjs7Vd8pZGH6SRpkNtoIAiw4", "auth": "BTBZMqHH6r4Tts7J_aSIgg"}}, "payload": {"title": "Đơn hàng #1024", "body": "Đã giao thành công"}, "ttl": 3600, "urgency": "high", "vapid": {"subject": "mailto:ops@example.com", "public_key": "BECWGWmqQ8K_C-FP8oHoC2GdtyNmQRTEHe8z3qsK5VDKHjkpMUG-RRrKyy-jczLPSqC1y15k6r_iPaGLt39VFOw", "private_key": "(your private key)"}},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/web-push');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY', 'Content-Type: application/json'],
    CURLOPT_POSTFIELDS => '{"action":"send","subscription":{"endpoint":"https://fcm.googleapis.com/fcm/send/abc","keys":{"p256dh":"BCVxsr7N_eNgVRqvHtD0zTZsEc6-VV-JvLexhqUzORcxaOzi6-AYWXvTBHm4bjyPjs7Vd8pZGH6SRpkNtoIAiw4","auth":"BTBZMqHH6r4Tts7J_aSIgg"}},"payload":{"title":"Đơn hàng #1024","body":"Đã giao thành công"},"ttl":3600,"urgency":"high","vapid":{"subject":"mailto:ops@example.com","public_key":"BECWGWmqQ8K_C-FP8oHoC2GdtyNmQRTEHe8z3qsK5VDKHjkpMUG-RRrKyy-jczLPSqC1y15k6r_iPaGLt39VFOw","private_key":"(your private key)"}}',
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

API documentation → Get a free API key

FAQ

Do you store my VAPID private key or the subscriptions?

No. Keys and subscriptions are used for the request only and never written to storage or logs. Send them with every call.

Which browsers does it work with?

Any browser that implements the standard Push API with VAPID: Chrome / Edge (FCM), Firefox (Mozilla autopush), Safari 16+ (Apple), Opera, Samsung Internet. The endpoint in the subscription decides the push service.

What does status 410 mean?

The push service says the subscription no longer exists (the user unsubscribed or the browser data was cleared). The result has gone: true; delete that subscription from your database.