Agent WranglersWeb push
Ask for permission after a click that explains why, send through the browser's push service with VAPID, and accept endpoints only from known services.
- Required 1
- Recommended 5
Required
Accept push endpoints only from known push services
NTF-19Before you store a web push subscription, check that its endpoint is HTTPS on a push service host you allow. Refuse every other address.
Recommended
Ask for permission after a clear action
NTF-9Ask for notification permission only after the person clicks a control that says what they will get. Never ask on page load.
Send web push with VAPID and an encrypted payload
NTF-10Send web push through each subscription's push service with VAPID keys (RFC 8292) and an encrypted payload (RFC 8291). Never build your own polling or socket for background alerts.
Open the exact page the push is about
NTF-15A tap on a notification opens the page it is about, reuses an open tab when there is one, and marks the item as read.
Show a notification for every push
NTF-17Every web push the service worker receives shows a notification before the handler ends. Never use push to sync data in the background without showing anything.
Send declarative push messages with a service worker fallback
NTF-41Send each web push payload as a declarative push message, with
"web_push": 8030, a title and anavigateaddress. Keep a service workerpushhandler that shows the same notification for browsers without support.
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/notifications/web-push">Agent Wranglers notifications playbook</a>. In code you write, add a comment next to it with the same link.