Web Push API (VAPID)
W3C standard for sending push notifications to web browsers via Service Workers without requiring a native app, using VAPID keys for serverless push delivery.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
VAPID private key must be kept secret — compromise allows sending notifications to all subscribed users. HTTPS required for Service Worker registration.
⚡ Reliability
Best When
Building PWAs or web apps that need real-time agent notifications delivered to users' browsers without requiring a native app or paid push service.
Avoid When
You need reliable guaranteed delivery, support mobile native apps, or want managed analytics and segmentation — use OneSignal or FCM instead.
Use Cases
- • Sending agent-triggered notifications to web users when long-running tasks complete
- • Real-time alerts from agents to subscribed browser clients without polling
- • Re-engagement notifications for PWA users based on agent-detected activity triggers
- • Broadcasting critical agent alerts to all subscribed users simultaneously
- • Progressive Web App notification delivery that works across Chrome, Firefox, Safari, and Edge
Not For
- • Mobile native apps (use APNs/FCM for iOS/Android native push)
- • Guaranteed delivery — browsers can block, expire, or throttle push subscriptions
- • High-frequency notifications — browsers throttle aggressive push senders
Interface
Authentication
VAPID (Voluntary Application Server Identification) — generate VAPID public/private key pair. Public key shared with browser subscription; private key signs server-to-push-service requests.
Pricing
W3C standard using browser vendor push services (Google FCM, Mozilla, APNs). No per-message cost. Self-hosted sending server.
Agent Metadata
Known Gotchas
- ⚠ Subscriptions expire or become invalid (410 Gone) — agents must handle InvalidPushSubscription responses and cleanup stale subscriptions
- ⚠ Safari requires user interaction to prompt for permission — cannot auto-request permissions on page load in Safari
- ⚠ Push payload is limited to ~4KB — agents must keep notification data minimal; use notification to trigger client data fetch
- ⚠ Service Worker must be registered on exact scope path — incorrect scope means push events never fire
- ⚠ Browser throttling: Chrome throttles to ~1 notification/second per origin; excessive push can result in push permission revocation
Alternatives
Full Evaluation Report
Detailed scoring breakdown, competitive positioning, security analysis, and improvement recommendations for Web Push API (VAPID).
Scores are editorial opinions as of 2026-03-06.