Skip to main content
Each scope is a door on your key: app, device registration, send, or read, open only what you need.
Each scope unlocks one type of Push operation. Use only what your integration needs.

​
How to send the key

Recommended
Alternative
Each API Key belongs to one workspace. You cannot access another workspace with the same key.

​
Common combinations

Send only

push:send

Send and query

push:send, push:read

Full Web setup

push:apps:manage, push:devices:register, push:send, push:read

Register devices only

push:devices:register
An empty scope list on creation = ADMIN access. Always restrict in production.

​
Available scopes

List and query Push Apps in the workspace.
Create, update (VAPID, FCM, APNs as product evolves), and delete Push Apps.
Register a device or subscription. Also used to remove a device.
Send immediate or scheduled notifications to up to 500 device IDs per request.
  • List and query sends
  • List and query devices
  • Cancel queued or scheduled push (QUEUED or SCHEDULED status)

​
Per-app limit

If the key has configured pushAppIds, it can only send to devices from those apps. Device from another app → 403 (PUSH_APP_NOT_ALLOWED). Empty list = any app in the workspace.

​
Common errors

Check Authorization: Bearer sk_... and that the key wasn’t deleted in the dashboard.
Check operation scope, pushAppIds on the key, and allowed origin on the app (ORIGIN_NOT_ALLOWED on public registration).
Insufficient credits (PLAN_LIMIT_CREDITS, INSUFFICIENT_CREDITS), expired plan (WORKSPACE_BLOCKED), or API key spend limit (API_KEY_SPEND_LIMIT_EXCEEDED).
Missing scope, app outside pushAppIds (PUSH_APP_NOT_ALLOWED), quiet hours (PUSH_QUIET_HOURS), or scheduling not allowed (PLAN_LIMIT_SCHEDULING).

​
Next steps