Understanding Web Push Notifications

This guide introduces you to web push notifications and explains how they work.
If you’re ready to get started, we recommend reading the Getting Started guide.

What Are Web Push Notifications?

Web push notifications — sometimes called Web Push or Web Notifications — are a set of modern web technologies that allow websites to send push alerts to users.
The key advantage? Notifications can be delivered even when the user isn’t actively browsing your site.

This is made possible through a combination of web standards, including:

  • W3C Push API
  • Service Workers
  • Web Notifications API
  • IETF WebPush Protocol

How Web Push Works

The process of subscribing to and receiving web push notifications involves several steps:

  1. User Visits the Website
    When a user lands on your website, a small JavaScript file called a service worker is installed in their browser. This service worker runs in the background and is responsible for displaying notifications later.

  2. Permission Request
    Your site asks the user for permission to send notifications (using PushManager.subscribe()). If the user agrees…

  3. Endpoint Creation
    The browser contacts its push service (e.g., Mozilla Autopush, Google FCM) to create a unique “mailbox” — technically a secret URL called an endpoint.
    Anyone with this endpoint can send notifications to that browser.

  4. Endpoint Registration
    The browser provides this endpoint to your website’s JavaScript, which then sends it to your application server.
    With Alertelevate, our platform securely stores and manages these endpoints for you.

  5. Sending a Notification
    When you want to notify a user, your server sends an HTTP POST request to the browser’s push service using the endpoint.

  6. Notification Delivery
    The browser stays connected to its push service, which delivers the message to the user’s device.
    The service worker wakes up, processes the message, and displays the notification.

Security: VAPID Protocol

To improve security, the VAPID (Voluntary Application Server Identification) protocol is used.
When a site calls PushManager.subscribe(), it provides a public key. The matching private key stays on the server and is required to sign all push requests.
This ensures that only authorized servers can send notifications to the endpoint.

With Alertelevate, all of this complexity is handled behind the scenes — so you can focus on engaging your audience while we take care of reliable, secure delivery.