About this tool
Apple Push Notification service tokens are a small but fussy piece of infrastructure: every request to APNs must carry a provider token — a JSON Web Token signed with the ES256 algorithm using the private key inside the .p8 file you download from the Apple Developer portal. This tool builds that token entirely in your browser. Paste the contents of your .p8 key, enter the ten-character Key ID from the portal, your Team ID, and your app's bundle ID as the topic, then choose how long the token should stay valid. Apple rejects provider tokens with a lifetime over sixty minutes, so the tool offers five, twenty and sixty minute options. When you press generate, the page imports the PKCS#8 key with the Web Crypto API, signs the header and payload with ECDSA on the P-256 curve, normalizes the signature to the raw r-and-s form that JWT expects, and assembles the final base64url token. You also get the decoded header and payload so you can sanity-check the kid, iss, iat and exp claims before pasting the token into curl or your push server. Your private key never leaves this tab: the signing happens locally with crypto.subtle and nothing is transmitted anywhere, so it is safe to use even with production keys.
How to use APNs JWT Generator
- Paste the full contents of your .p8 key file, including the BEGIN/END PRIVATE KEY lines.
- Enter the Key ID (from the Apple Developer keys page), your Team ID and your app's bundle ID as the topic.
- Choose a validity period — Apple rejects provider tokens valid for longer than 60 minutes.
- Press Generate, then copy the signed ES256 token into your push request's authorization bearer header.
Frequently asked questions
Is it safe to paste my .p8 private key here?
Yes. The key is imported and used with the Web Crypto API entirely inside your browser tab. It is never uploaded, logged or stored — close the tab and it is gone.
Why does the token expire after at most 60 minutes?
Apple requires provider tokens with a lifetime of no more than one hour and expects you to reuse each token for up to an hour before minting a new one. The 5, 20 and 60-minute options cover quick tests and production reuse.
What claims go into the token?
The header carries alg ES256 and your Key ID as kid; the payload carries your Team ID as iss plus iat and exp timestamps. APNs verifies the signature against the public key Apple holds for that Key ID.
Does this work for the sandbox environment?
Yes — the same token format works for both api.sandbox.push.apple.com and api.push.apple.com; only the host and, usually, the topic change. Sign once and point your request at either environment.