I am developing a VoIP service. Usually, when receiving a VoIP Push, Callkit is exposed immediately after receiving the message and the app is designed to be used. However, there is an extremely intermittent phenomenon (not well reproduced) where the app does not wake up even when receiving a VoIP Push. And after a long time, the app wakes up and Callkit is activated. (A long time after receiving the call…) Has anyone experienced the above phenomenon? I wonder if there are any reported parts depending on the OS version. (I have identified that it does not occur in the 17.x version, but it is difficult to guarantee because it occurs extremely intermittently) The app is not running in the background, but... Could this be happening if there are a lot of pending operations in the background? I need help urgently

UNNotificationAttachment convenience init method seems to be checking for supported file types based on the extension of the file URL provided as a constructor parameter. This seems to be sub-optimal at best and incorrect at worst. Is this is a known issue for which a bug already exists?

Hi Team, We’re following up on our request for the Critical Alert entitlement for our app, which we plan to use to notify users about critical states of their devices. It’s been almost 4 weeks since we submitted the request, and we wanted to check on the typical review timeline so we can plan our upcoming work accordingly. If there’s anything we can provide or clarify to help complete the review or make the process easier, we’d be happy to assist. or the right forum to reach out to.

Hello Apple Developer Community, We’re building an MDM product (SaaS, multi-tenant). I’d like clarification on the APNs MDM push certificate usage model for service providers (MSPs). Question: Is it acceptable for an MDM vendor to use a single APNs MDM push certificate owned by the vendor to manage devices for multiple, independent customer organizations? Or is it required/recommended that each customer (company) must obtain and use its own APNs MDM push certificate (issued under the customer’s Apple ID) for their tenant? Why we’re asking: We understand that many guides show the process where each customer logs into the Apple Push Certificates Portal with their own Apple ID, uploads a CSR provided by the MDM, and then renews yearly. Practically, for a small team and early-stage deployments, using one vendor-owned certificate across multiple tenants would be simpler. We want to ensure we’re not violating any policy, terms, or technical requirements (e.g., certificate ownership, topic binding, device token isolation, audit/compliance expectations). What we need from Apple (or authoritative sources): An official Apple document or policy that clearly states whether per-customer certificates are mandatory vs strongly recommended for MSP/multi-tenant MDMs. If per-customer is mandatory, please point to the relevant clause or section. If a vendor uses a single certificate for multiple organizations, what risks or consequences should we expect (e.g., compliance issues, supportability, potential program violations, off-boarding problems, etc.)? Context: We’re sending only MDM wake notifications (standard MDM flow). We understand certificates expire yearly and must be renewed with the same Apple ID to avoid device re-enrollment. We want to follow Apple’s best practices while keeping early operations manageable. Any guidance, links to official documentation, or clarification from Apple engineers/moderators would be greatly appreciated. Thank you!

Hello, we have a problem with fake call on iPhone device for incoming calls. When I leave the iPhone in idle state for 30, 40 seconds and dialed voip app number the iPhone rings and there is no problem. When I leave it in idle for longer time one minute or two minutes I get "Call Failed to Connect" on iPhone's display and after this fake call I get second call with real calling number displays on iPhone. This first fake call is triggered by wake up push notification type 'voip'. If I switched off this wake up push notification type 'voip' and device's token has not expired yet I don't get fake call and iPhone's directly displays calling number. But in this situation we need to use wake up push notification type 'voip' on during a certain time to keep the device's token in our database and continuing to receive calling number without fake call. If we switched off the wake up push notification type 'voip' on certain time we need to activate again wake up push notification type 'voip' for incoming calls to wake up the iPhone. And in this way every time on every incoming call the iPhone's will display first fake call "Call Failed to connect" and after that the call with Calling number. How we can eliminate this fake call and use only one wake up push notification only for incoming calls not use second type wake up push on certain time? Thank you, I paste here our code for this: public ApnClient(IOptions settings) { var httpHandler = new HttpClientHandler() { ClientCertificates = { new X509Certificate2(certificate.Export(X509ContentType.Pfx)) }, }; ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls13; this.httpClient = new HttpClient(httpHandler) { DefaultRequestVersion = HttpVersion.Version20, DefaultVersionPolicy = HttpVersionPolicy.RequestVersionOrHigher, BaseAddress = new Uri(settings.Value.ApnProdBaseUri), DefaultRequestHeaders = { { "apns-topic", ApnsTopic }, }, }; } public async Task<bool> WakeUpDevice(string deviceToken, string callId) { this.requestContent = new StringContent( $"{{\"aps\":{{\"content-available\":\"1\"}}}}", System.Text.Encoding.UTF8, "application/json"); var res = await this.httpClient.PostAsync($"/3/device/{deviceToken}", this.requestContent); return res.IsSuccessStatusCode; }

My iPhone VoIP app, which I'm developing, uses Apple Push Notification service (APNs). I have a question regarding the following statement found in "[Overview of app transfer > Apps using push notifications]" Overview of app transfer You must manually reestablish push notification services if transferring an app that uses the Apple Push Notifications service (APNs). The recipient must create a new client SSL certificate using their developer account, as associated client SSL certificates, TLS certificates, and authentication tokens aren’t transferred. Question Let's say the recipient of the app transfer creates a "new SSL certificates, TLS certificates, and authentication tokens." Afterward, we need to verify that the Apple Push Notification service (APNs) works correctly when combining the transferred app with this "new SSL certificates, TLS certificates, and authentication tokens." However, until the recipient finishes verifying that it works correctly, the transferor want to keep the app available for download as before and be able to use the Apple Push Notification service. Is this possible? More specifically, can the recipient test the app to be transferred on TestFlight "before the transfer is completed"? I want to combine it with the "new SSL certificates, TLS certificates, and authentication tokens." and test it on TestFlight. Reading "[Initiate an app transfer]," it mentions the existence of a "Pending App Transfer" status. During this "Pending App Transfer" status, can the recipient test the app on TestFlight? Initiate an app transfer After you initiate the transfer, the app stays in its previous status, with the Pending App Transfer status added, until the recipient accepts it or the transfer expires after 60 days. Also, if there are any documents describing these procedures, I would appreciate it if you could share them. Thank you very much.

Hi all, We encountered an issue where APNs (Apple Push Notification service) push messages cannot be received during development. The specific description is as follows: Our app runs on an iPad that connects to the cellular network using a SIM card and accesses the Internet through the company's MDM, which provides APN setting proxies. During operation, we found that the device fails to receive push messages from APNs. Network packet capture revealed that the connection attempt by apsd to port 5223 failed. According to Apple's documentation (https://support.apple.com/zh-cn/102266), when port 5223 cannot be connected to, it will fall back to port 443 and use a proxy. However, our packet capture showed that when port 5223 was unreachable, the apsd service on the iPad did not attempt to establish a connection to port 443. Since the iPad device currently cannot establish a connection with APNs, it consistently fails to receive push messages from APNs. We tried disconnecting the SIM card and using a Wi-Fi environment, and in this case, the iPad device was able to receive push messages from APNs normally. Could you advise us on how to proceed with troubleshooting in this situation?

We are developing a messaging app which sends End-to-End encrypted data. The application supports multiple types of E2EE data, including text messages and voice over IP calls. Apple's article titled “Sending End-to-End Encrypted VoIP calls” (https://developer.apple.com/documentation/callkit/sending-end-to-end-encrypted-voip-calls) states that the following steps are required to support E2EE VoIP calls: Request permission to receive remote notifications through the User Notifications framework Register for VoIP calls using PuskKit Add a Notification Service Extension target to your app. Add the com.apple.developer.usernotifications.filtering entitlement to the NSE target’s entitlements file. We have completed steps one through three. We are still missing the filtering entitlement. As of right now the system does not allow us to use reportNewIncomingVoIPPushPayload(_:completion:) method because of the missing entitlement.
 Below is a short description of how our messaging app works: User sends a message to another user. The message is encrypted on device and sent to our server. The server receives the message and sends a notification request to APNs if needed. The server cannot decrypt the message. As an additional security feature we do not pass the encrypted message in the notification payload. The notification payload only contains a localizable generic placeholder message string and default sound in the ‘aps’ dictionary part. Upon receiving a notification from our server, the NSE makes a request to our server and fetches the latest messages (encryption keys have already been exchanged between the participants of the conversation) and determines what to do next (display a banner, or pass a call to CallKit). E2EE VoIP calls are a core feature of our app, so it is imperative that we receive the filtering entitlement. Our capability request has been rejected twice now. The latest request was rejected because: Support for VoIP calls should be provided by PushKit. For more information, please consult the documentation page "Responding to Notifications from PushKit". We cannot support VoIP calls by solely relying on PushKit. Our server cannot make a distinction when to use ‘voip’ (call) and ‘alert’ (text message) apns-push-types. Therefore, the application must be able to use reportNewIncomingVoIPPushPayload(_:completion:) function, where com.apple.developer.usernotifications.filtering entitlement is needed. We have sent the above text to support two weeks ago and made yet another request. Has anyone been able to get the capability as of late? What are the magic words that need to be included in the capability request? Can someone here help us? We made the first request on 3rd of September so this process has taken two months. Our planned release date is coming up and the absence of the capability is holding us back. We already have a released desktop and Android versions so changing the server implementation is really not an option.

Hi, we've observed a weird behavior for a small amount of our user that we keep receiving the same token from APNs despite it's shown as Unregistered. When we try to send push to the token, we got an Unregistered error so we remove that token from our server. However, later we would receive an add token request from the client with the same token we just removed, and when we try to send to the token it returns Unregistered again so we remove the token again. This happened 3 times for a user in an hour. The identifierForVendor remains the same for all the requests. We also owns the client and I've checked client code that it's sending the token it received from didRegisterForRemoteNotificationsWithDeviceToken to the server.

We are encountering the following issue with our VoIP application for iPhone, published on the App Store, and would appreciate your guidance on possible countermeasures. The VoIP application (callee side) utilizes a Wi-Fi network. The sequence leading to the issue is as follows: VoIP App (callee): Launches iPhone (callee): Locks (e.g., by short-pressing the power button) VoIP App (callee): Transitions to a suspended state VoIP App (caller): Initiates a VoIP call VoIP App (callee): Receives a local push notification VoIP App (callee): Answers the incoming call VoIP App (callee): Executes performAnswerCallAction() After this, the VoIP App (callee) uses "NSTimer scheduledTimerWithTimeInterval" to manage internal processing timing. However, the processing sometimes takes longer than the specified waiting time. Specifically, delays of several seconds can occur. We understood that if the user is interacting with the screen and both the iPhone and the VoIP app are in an active state, the VoIP app's processing would not be delayed. However, can significant delays (several seconds) in application processing still occur even when the iPhone is in an active state (i.e., the user is interacting with the screen)?"

I dont want my server to be spammed. Currently I am only in payment-related notifs (eg: user successfully renewed his subscription, user didnt successfully renew his subscriptions, ..) Where can I set that?

Having some discussion about when we should clear out a token from our servers. Docs say: Don’t retry notification responses with the error code BadDeviceToken, DeviceTokenNotForTopic, Forbidden, ExpiredToken, Unregistered, or PayloadTooLarge. You can retry with a delay, if you get the error code TooManyRequests. The way I see it is that with the exception of PayloadTooLarge, all other errors means you should remove the token from your server. Either because: The token is no longer good The token is good, but this is just not the right: environment (sandbox vs production) topic (the token is from a different bundle id or developer team) target (app vs live activity appex) Do I have it right? Extra context: when using the "JSON Web Token Validator" tool, a colleague reported that a 410 -Expired token (from couple days back) was still valid today. This raises questions about when tokens should actually be deleted and how these error codes should be interpreted. Also is it possible for the docs to get updated for us to explicitly know if a token should get removed and not leave it for interpretation?

Hello, We are currently facing a persistent issue where Apple Push Notifications (APNs) are no longer being delivered to devices. This is not an intermittent problem — push notifications have completely stopped working. We are using PushSharp.Apple (Version 4.0.10.0) to send the notifications. Current Behavior (Failing): Every notification request appears to be processed successfully from the server side. However, the APNs client receives a 0-byte response, and the server closes the connection. Devices do not receive the notifications at all. Logs from Current (Failing) State: APNS-Client[1]: Connected (Batch ID=1) APNS-Client[1]: Sent Batch, waiting for possible response... APNS-Client[1]: Received 0 bytes response... APNS-Client[1]: Server Closed Connection... APNS-Client[1]: Disconnected (Batch ID=1) For Reference – Successful Log From Earlier (When Notifications Worked): APNS-Client[1]: Connected (Batch ID=1) APNS-Client[1]: Sent Batch, waiting for possible response... APNS-Client[1]: Received -1 bytes response... Push Notification Successfully Sent to Device Any help, suggestions, or experience with similar issues would be greatly appreciated. Thanks!!!

We are observing an issue where the iOS Notification Service Extension (NSE) is terminated by the system during startup, before either didReceive(_:withContentHandler:) or serviceExtensionTimeWillExpire(_:) is invoked. When this occurs, the notification is delivered without modification (for example, an encrypted payload is shown to the user). System logs frequently contain the message “Extension will be killed because it used its runtime in starting up”. During testing, we observed that CPU-intensive operations or heavy initialization performed early in the extension lifecycle — especially inside init() or directly on the main thread in didReceive often cause the system to kill the NSE almost immediately. These terminations happen significantly earlier than the commonly observed ~30-second execution window where the OS normally invokes serviceExtensionTimeWillExpire(_:) before ending the extension. When these early terminations occur, there is no call to the expiry handler, and the process appears to be forcefully shut down. Moving the same operations to a background thread changes the behavior: the extension eventually expires around the usual 30-second window, after which the OS calls serviceExtensionTimeWillExpire(_:). We also observed that memory usage plays a role in early termination. During tests involving large memory allocations, the system consistently killed the extension once memory consumption exceeded a certain threshold (in our measurements, this occurred around 150–180 MB). Again, unlike normal time-based expiration, the system did not call the expiry handler and no crash report was produced. Since Apple’s documentation does not specify concrete CPU, memory, or startup-cost constraints for Notification Service Extensions or any other extensions beyond the general execution limit, we are seeking clarification and best-practice guidance on expected behaviors, particularly around initialization cost and the differences between startup termination. NSE Setup: class NotificationService: UNNotificationServiceExtension { static var notificationContentHandler: ((UNNotificationContent) -> Void)? static var notificationContent: UNMutableNotificationContent? static var shoudLoop = true override func didReceive(_ request: UNNotificationRequest, withContentHandler contentHandler: @escaping (UNNotificationContent) -> Void) { NotificationService.notificationContentHandler = contentHandler NotificationService.notificationContent = request.content.mutableCopy() as? UNMutableNotificationContent NotificationService.notificationContent!.title = "Weekly meeting" NotificationService.notificationContent!.body = "Updated inside didReceive" // Failing scenarios } override func serviceExtensionTimeWillExpire() { NotificationService.shoudLoop = false guard let handler = NotificationService.notificationContentHandler, let content = NotificationService.notificationContent else { return } content.body = "Updated inside serviceExtensionTimeWillExpire()" handler(content) } }

I am creating an app that uses critical messages, I have been granted this entitlement and I am adding the certificate and in the info.plist. In the app I request authorization to send messages to specific numbers. When I try the app in production from Xcode this works fine and I can send the critical messages. However, when I am using the app in the test flight the authorization does not seem to be remembered on the background. Moreover, I go to security/privacy settings and I grant permission to the selected number (I see that it only shows one number even when I have to granted, its like it removes the previous one) however when I exit the setting page the permission is reset (and therefore denied), I think this is a bug. Can you look into that. Both this removing granted permission (HIGH PRIORITY, this message can only be sent in the background, therefore the user can not grant it and why the maximum telephone number to be granted to send messages is reset also to a single one LOWER PRIORITY). Thanks

We're experiencing an issue with Apple Push Notification service where APNs continues to return 200 OK responses for device tokens belonging to uninstalled applications. Issue Details: When sending push notifications to device tokens. APNs returns 200 OK responses even for devices where our app was uninstalled more than a month ago According to documentation(https://developer.apple.com/documentation/usernotifications/handling-notification-responses-from-apns), APNs should return 410 status code with JSON body for invalid tokens Expected Behavior: APNs should return 410 status code when device token is no longer valid (app uninstalled) Thanks in advanced for support

This error has been continuously occurring for about 9 hours. We have not replaced the certificate, modified the server code, or changed the firewall policy. Some requests succeed, but many are timing out, with several timeouts occurring every minute. We are unable to find the cause. Please help. APNS Exception io netty channel ConnecttimeException: Connection timed out
APNSOutboundHandler api.push.apple.com/17.188.169.28:443 api.push.apple.com/(other ip):443 api.push.apple.com/(other ip):443 api.push.apple.com/(other ip):443 api.push.apple.com/(other ip):443 ...

I’m receiving notifications from all third-party apps that I use however, most of the time there is no sound or haptics with the notification. In some cases, very seldomly I will receive a sound when a notification comes in, but that’s only with one of the many third-party apps that I use. I’ve spoken to Apple about this when this whole problem started during an update that you guys rolled out sometime between September and November 2024. They blamed it on the app programmers but I think at this point we all know that it’s Apple’s inability to accept that the problem is on their end. I never had problems receiving notifications from any of the apps prior to that. I guess my question is will Apple ever fix this or are they going to sweep it under the rug and pretend like it doesn’t exist?

Hey there,i start a live activity,but it not works, and sometime it can work; apns-unique-id 46445cfa-1bf6-0f63-5ea3-2afa53e02b0d and it show that " 2025年5月19日 GMT+8 15:13:25.836 received by APNS Server 2025年5月19日 GMT+8 15:13:26.244 discarded as application was not registered" but i did not know how can i do; thanks for you help

When User restarted iOS device, after powering on iOS App is not able to get VoIP push notification. If user opens App, immediate VoIP push receiving. In Normal (App Kill or Background state) everything works as expected. Issue is when device is powered on and immediately( In 1-2 mins) try to call on device. We are using delegate to show Call to User public func pushRegistry(_ registry: PKPushRegistry, didReceiveIncomingPushWith payload: PKPushPayload, for type: PKPushType, completion: @escaping () -> Void)