How Web Push Actually Works: Service Workers, VAPID and FCM in Plain Terms
Web push looks simple from the outside. A visitor clicks "Allow", and later a notification appears even though your site is closed. Underneath, there are four moving parts, and once you understand how they fit together, most push bugs become easy to diagnose. This is a developer-friendly walkthrough of the whole flow, with no vendor SDK in the way. The four parts Your site , which asks for…
Web push notifications operate through a four-part system involving your site, a service worker, a push service, and your application server. The process begins with a service worker, a script stored on your site's domain, which is responsible for receiving push messages. After the service worker is registered, permission is requested from the user, ideally after a user gesture and a brief explanation of the notifications they'll receive.
Next, your site generates a VAPID (Voluntary Application Server Identification) key pair to authenticate with the push service. This key pair includes a public key stored on your server and a private key kept secret. When you send a push notification, your server encrypts the message using the subscriber's public key and signs it with your VAPID private key.
The push service, which could be Firebase Cloud Messaging for Chrome, Mozilla's autopush for Firefox, or Apple's service for Safari, then delivers the encrypted message to the user's browser. The browser wakes up the service worker, which shows the notification to the user. The server's responses to the push requests are crucial for debugging; a 201 Created indicates successful delivery, while a 404 or 410 means the subscription is no longer valid and should be deleted.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
