Conversation

Jun 15, 2022

Replying to

Is that right? You can't do anything with it without the team and token ID. I was torn on this. I couldn't find anywhere in Apple's documentation that this was supposed to be "secret" or whatever.

Replying to

I was always super cautious about it. This article says: "Remember to secure your .p8 key file, as anyone who have it can send push notification to all of your App Store apps! If you suspect the key file might be compromised, please [...] revoke it."

fluffy.es

Using .p8 key file to send push notification

TL;DR Jump to how to generate p8 key file or using p8 key file in Firebase Generating push certificate can be a painful process, especially when the push notification provider / library requires a...

Replying to

Interesting. That isn't entirely true though, right? Even if someone found the team ID and bundle identifier they would need the key ID. Hmm...

Replying to

Yeah, but I think the cert is the most "secret" part that you need in that trio of keys/ids.

Replying to

That's fair. Might have to rework the Noticed integration then!

Replying to

and

I came here to say this too. Private keys are meant to be private. I put my private key into rails credentials. You can feed a StringIO of the key data to Apnotic’s cert_path option.

Replying to

and

In your credentials yaml file you can add: apns_token_cert: |- -----BEGIN PRIVATE KEY----- blah blah -----END PRIVATE KEY----- Then tell Noticed `StringIO.new(Rails.application.credentials.apns_token_cert)`