Agent WranglersPush notifications
Ask for permission after a click that explains why, send through the standard push services with short lives, and drop dead subscriptions at once.
- Required 5
- Recommended 2
Required
Ask for permission after a clear action
RequiredAsk for notification permission only after the person clicks a control that says what they will get. Never ask on page load.
Send web push with VAPID and an encrypted payload
RequiredSend web push through each subscription's push service with VAPID keys (RFC 8292) and an encrypted payload (RFC 8291). Never build your own polling or socket for background alerts.
Use the current APNs and FCM interfaces
RequiredSend to Apple devices through APNs over HTTP/2 with token-based auth, and to Android through the FCM HTTP v1 API. Never use the retired legacy FCM API.
Delete dead subscriptions and tokens at once
RequiredDelete a push subscription or device token as soon as the service says it is gone. Remove tokens the app has not refreshed for 270 days.
Keep push payloads short and safe on a lock screen
RequiredPut no secrets, codes, health or money details in a push. Show a neutral line and the details only after sign-in. Keep the payload JSON at or under 3,993 bytes.
Recommended
Give every push a lifetime and a topic
RecommendedSet how long each push may wait for an offline device. Give updates a topic, so a newer push replaces the older one.
Open the exact page the push is about
RecommendedA tap on a notification opens the page it is about, reuses an open tab when there is one, and marks the item as read.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers notifications playbook: https://agentwranglers.se/playbook/notifications/push-notifications.