What is a push token, and how does it work?

A push token is a unique identifier used in mobile apps to receive push notifications from a server. When the app registers for notifications, the operating system obtains a push token from the platform’s push service, and the app sends it to its server. The token acts as an address that enables the server to send messages to the specific app on the specific device.

Push tokens are essential for ensuring that notifications are delivered correctly to the right app installations. On iOS and Android 13 and later, notifications are only displayed if the user has given permission. When the server wants to send a notification, it uses the push token to address the right device via a push notification service, such as the Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM) for Android.

Compared with communication methods in which each app has to maintain its own connection or poll the server, push notifications are more efficient, as the operating system handles a single shared connection and the app is only woken when there is a message. This reduces power consumption and data usage.

A push token is a unique identifier issued via the device’s operating system when an app registers to receive push notifications. The token is used by servers to send messages to the specific device via a push notification service such as the Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM).

The push token is typically generated when the app registers for remote notifications, often at start-up, and it can be obtained before the user has granted permission to display notifications. The operating system contacts the push notification service, which returns a token that is unique to that app and device. The token is then sent to the app’s server, which stores it for future use when notifications are to be sent.

To ensure the security of push tokens, several important measures should be taken:

• Encryption: Push tokens should always be sent over secure connections (e.g. HTTPS) to prevent eavesdropping and unauthorised access.
• Storage: Tokens should be stored securely on the server, preferably in an encrypted database, to protect against data breaches, as they can be linked to a user and are treated as personal data under the GDPR.
• Validation: Mechanisms should be implemented to update tokens and remove invalid ones, as tokens can become invalid if a user uninstalls the app or changes device.
• Restricting access: Only authorised system components should be able to send notifications, and the credentials for the push service, such as APNs keys and FCM service accounts, must be kept secret.

Following these security measures minimises the risk of misuse of push tokens and ensures that notifications only reach the intended recipients. This is crucial for maintaining users’ trust and protecting their privacy.

Push tokens are a central component of modern app development that can improve user engagement significantly by enabling direct and targeted communication with users. Push tokens act as unique identifiers assigned to each app installation when the app registers for push notifications. These tokens enable app developers to send tailored messages to specific users, increasing relevance and engagement.

In addition, push tokens can be linked to user profiles so that users can be segmented based on their behaviour and preferences, making it possible to deliver personal experiences. For example, an e-commerce app can send notifications about special offers to users who have previously shown interest in particular product categories. This targeted approach ensures that users receive content that is relevant to them, increasing the likelihood of interaction and conversion. Marketing messages require the user’s consent, and too many notifications can lead users to switch them off.

Compared with communication methods such as email, which is often overlooked or ends up in spam folders, push notifications offer a more direct and immediate way of reaching users. Push tokens enable messages to be delivered within seconds in most cases and displayed directly on the user’s device, making them an effective tool for capturing attention and driving engagement.

The terms are often used about the same thing, but they can also refer to different concepts. On iOS, the push token issued by the Apple Push Notification service (APNs) is officially called a device token, while Firebase Cloud Messaging (FCM) calls it a registration token. In both cases, it is a unique identifier used to send push notifications to a specific app on a device. The token is dynamic and can change, for example when the app is reinstalled, restored on a new device or its data is cleared.

In other contexts, a device token or device ID refers to an identifier linked to the device itself rather than to push notifications. Such identifiers are often used to recognise devices in backend systems, for example for fraud prevention or device-specific services. Permanent hardware identifiers are now largely inaccessible to apps on both iOS and Android for privacy reasons, so app-specific identifiers are used instead, such as identifierForVendor on iOS.

Compared with push tokens, which are designed to enable notifications from servers to apps, such device identifiers focus on identifying and managing devices more broadly. Both types play a role in the app ecosystem, but their use and functionality are tailored to different aspects of app and device management, and they should not be confused with each other.

Handling push token changes and renewal in an app is a critical part of ensuring that push messages are delivered reliably to users. Push tokens are unique identifiers assigned when an app registers for push messages, and they can change or become invalid for various reasons, such as app reinstallation, restoring the app on a new device or clearing the app’s data.

When a push token changes, it is important that the app passes the new token on to the server quickly to maintain the connection to the push message service. Rather than checking validity itself, the app should register for push notifications on each start and listen for the callbacks or events the platform provides when the token is updated, such as onNewToken in FCM, and then update the server with the new token. On the server side, responses from the push service indicating that a token is no longer valid should be used to remove it.

Compared with other methods of maintaining connections, such as constant polling, this approach is more efficient, as action is only required when the token changes. This reduces unnecessary network traffic and saves resources, which is particularly important for optimising the app’s performance and user experience.

Push tokens are an essential part of modern app development, as they enable the delivery of push notifications to users’ devices. To ensure effective and secure handling of push tokens, there are several best practices that developers should follow in the app development process.

First, it is important to ensure that push tokens are kept up to date. Push tokens can change when a user reinstalls an app or restores it on a new device, so it is crucial to handle token renewal correctly to avoid losing the connection to the user. This can be achieved by implementing a mechanism that automatically updates the token in the backend system when a change is detected.

In addition, push tokens should be stored securely to protect users’ privacy. It is recommended to encrypt tokens both in transit and at rest to prevent unauthorised access. Using secure communication protocols such as HTTPS provides further protection against potential security threats. When a user logs out, the token’s link to the account should be removed so that notifications are not sent to the wrong person.

Another important practice is effective handling of inactive tokens. When a push token becomes inactive, for example because a user has uninstalled the app, it should be removed from the system to optimise resource consumption and avoid unnecessary attempts to send notifications. This can be done by monitoring the push service’s responses and automatically deleting tokens that it reports as invalid or unregistered.

Compared with other methods of user engagement, such as email or SMS, push notifications are more direct and can deliver timely updates. By following these best practices, developers can ensure that push notifications remain a reliable and secure communication channel that improves the user experience and engagement.