# APNs setup

> Give Xulo the Apple key or certificate it sends with. A .p8 auth key is recommended and can be shared by every app on the same Apple account.

URL: https://docs.xulo.io/ios/apns-setup
iOS SDK version: 0.1.4

Xulo sends each push through the app's own Apple credentials. Add them in the dashboard under **Settings → Platforms**. Until an app has them, a push stays a draft and is not sent. The same credentials are used for Apple's sandbox and production gates. See [Sandbox and production](#sandbox-and-production).

You can use either:

| Option | Notes |
| --- | --- |
| `.p8` Auth Key | Recommended. Does not expire. One key belongs to an Apple developer account and can be used by every app from that account. |
| `.p12` Certificate | Expires. Needs its password. It stays on the one app it was uploaded to. |

## Upload a .p8 auth key

1. In your Apple developer account, create a key with Apple Push Notifications service enabled, and download the `.p8` file. Note its **Key ID** and your **Team ID**.
2. In the dashboard, open the app's **Settings → Platforms** and choose **.p8 Auth Key**.
3. Give the key a **Name**, choose the file, and enter the **Key ID** and **Team ID**.
4. Save.

The key is stored in your organization under that name. Its file is never shown again.

## Reuse a saved .p8

For another app from the same Apple developer account, open its **Settings → Platforms**, choose **.p8 Auth Key**, and pick the key under **Saved .p8**. You do not upload the file again.

A different Apple developer account needs its own `.p8`. A key with a different Key ID is stored as a separate `.p8`.

The **Saved .p8 keys** window renames a key or deletes it. Deleting a key removes it from every app that uses it, and those apps can no longer send until they get a key again.

## Upload a .p12 certificate

Choose **.p12 Certificate**, choose the file, and enter the **Certificate password**. The certificate is used only by this app.

## Check

With credentials missing, pressing **Send** leaves the push a draft with the message "Still a draft. Apple credentials are missing, so this was not sent."

## Sandbox and production

Apple has two push gates. A token from a build signed with a development profile, such as a run from Xcode, works only on the sandbox gate. A token from a TestFlight or App Store build works only on the production gate.

Xulo picks the gate per install. You do not set it in the dashboard, and the app uses the same Apple key or certificate for both.

- From version 0.1.4, the SDK reads `aps-environment` from the app's embedded provisioning profile and reports it with each registration. `development` means sandbox. `production` means production.
- With no embedded profile, or any other value, the SDK reports production. The choice follows the profile, not the Debug or Release configuration, so a Release build signed with a development profile is still sandbox.
- Xulo sends each push to the gate its install reported. An install that never reported a gate, including every install from an SDK older than 0.1.4, is sent through production.
- An install imported from a CSV or another provider is set to production until the SDK registers it again.
- When Apple says a token is no longer valid on the install's own gate, Xulo marks that install as not subscribed.

See [Troubleshooting](https://docs.xulo.io/ios/troubleshooting#nothing-arrives-on-a-build-from-xcode) if a build from Xcode receives nothing.