APNs Authentication Key Replacement and Impact on Existing Device Tokens

Question

jonghwanchoi OP

Created 1w

Replies 1

Boosts 0

Participants 2

Hello,

I have a question regarding the replacement of the APNs authentication key (.p8) in a Firebase setup for push notifications.

Currently, my app uses an APNs authentication key from the original Apple Developer account. However, we are in the process of transferring app ownership to a new Apple Developer account, which will require generating a new APNs authentication key and updating it in Firebase.

My concerns are:

Impact on Existing Device Tokens: If we replace the existing .p8 key with a new one generated from the new developer account, will the existing APNs device tokens remain valid, or will they need to be reissued?

Push Notification Delivery: Will Firebase still be able to send push notifications to devices that were registered with the previous APNs authentication key after the key is replaced?

Steps for a Smooth Transition: Are there any best practices or additional steps we need to follow to ensure uninterrupted delivery of push notifications during and after the key replacement?

Any insights or guidance from the Apple Developer team or community would be greatly appreciated.

Boost

Answer 1

Engineer OP

Apple

1w

As long as the Bundle ID of the app does not change during the transfer, the new team will be able to send notifications to the old version of the app which has been built by the old team. The tokens will not change either, so the transition is normally smooth.

Once the app's ownership has passed to the new team, the new authentication key (created by the new team) can be used for that app/apns-topic, regardless of who signed the app that is running on the user's device.

It might be easier to think of this as not sending a notification to an app, but to a topic, and who has the right to send any notifications to that topic. In most cases the topic is the app's Bundle ID.

The app and the associated token should continue to receive notifications, and you can use the existing infrastructure and credentials during transfer.

But once the transfer is complete the existing Certificates or APNs Auth Keys from the old Team will stop working, so you would need to update them to ones from the new Team.

Once the transfer is complete, the apns-topic (which is, or based on the app Bundle ID) to send the pushes to will no longer belong to the old team, and their credentials can no longer be used. Once the topic is moved to the new team's account, only the new team can authenticate.

When the app is removed from the old team, their push requests will start to fail. At that point, you should be able to start using the Certificates or Keys generated by the new team.

Even though there could be a gap between the two, we expect the time span to be trivial.

NOTE after the transfer, any and all connections from your push servers and APNs will need to be reset and new connections with the new credentials established.

It would be best to coordinate all this with Firebase, as it is their servers which will need to be using the new key and managing the connections.

Just to clarify, the new key becomes active when the transfer is complete, not when it is created. While you can create the key any time you want, the provider tokens created using the new key will not be valid until the transfer is complete and a trivial but non zero propagation time has passed for all systems to be synced.

Argun Tekant /  DTS Engineer / Core Technologies

0