How Web Push Notifications Work in iOS 16 Safari

Starting with iOS 16.4, Apple added support for standard Web Push APIs in Safari, allowing web applications to send push notifications directly to iPhones and iPads. This functionality relies on standard web technologies, including Service Workers, the Push API, and the Notifications API, combined with Apple Push Notification service (APNs). This guide breaks down the core requirements, technical workflow, and delivery pipeline used to send web push alerts to iOS devices.

Prerequisites for Web Push in iOS 16

Unlike desktop Safari, iOS enforces a specific condition before a website can deliver web push notifications:

  • Home Screen Installation: The user must explicitly add the website to their Home Screen as a Progressive Web App (PWA) using the "Add to Home Screen" option in Safari.
  • Direct User Interaction: The permission prompt cannot be triggered automatically on page load. It must be initiated by an explicit user gesture, such as tapping a "Subscribe" or "Turn on Notifications" button inside the installed web app.

The Technical Delivery Pipeline

Web push on iOS operates through a coordinated process involving the client-side Service Worker, the application server, and APNs.

1. Service Worker Registration and Permission

When the installed app runs, it registers a Service Worker. Once the user interacts with a subscription element, the app calls Notification.requestPermission(). If granted, the app gains the authority to present alerts to the system.

2. Creating the Push Subscription

The application uses the PushManager.subscribe() method to generate a push subscription. This request communicates with APNs to create a unique endpoint URL for that specific device and app instance.

The subscription object contains:

  • Endpoint: A unique APNs URL to which the backend server will send messages.
  • Keys: Public cryptographic keys (p256dh and auth) used to encrypt payload data end-to-end.

The client then transmits this subscription object to the application's backend server, where it is stored in a database.

3. Dispatching the Notification from the Server

When an event triggers a notification, the server prepares the payload. Apple utilizes the Voluntary Application Server Identification (VAPID) protocol (RFC 8292) to verify the sender's identity.

  • The server encrypts the payload using the client's public keys.
  • The server signs the request using its private VAPID key.
  • The server sends an HTTP POST request containing the encrypted payload to the unique APNs endpoint URL.

4. APNs Routing and System Display

Once APNs receives and authenticates the POST request, it routes the message over Apple's persistent device connection to the user's iOS device.

  • iOS receives the message, identifies the associated Home Screen app, and wakes up its Service Worker in the background.
  • The Service Worker fires a push event containing the decrypted payload.
  • The event listener executes self.registration.showNotification(), rendering the alert in the iOS Notification Center, on the Lock Screen, and as system banners according to the user's focus and notification settings.