Authentication - Pushctl Documentation

Send an application token in every request:

Authorization: Bearer push_live_your_token

Tokens belong to one application. A valid token cannot read or change another application’s resources.

Required abilities

Ability	Operations
`installations:write`	Register and update an installation
`installations:read`	Get an installation
`notifications:send`	Send a notification
`notifications:read`	List and get notifications
`events:write`	Report a delivery event

Bearer tokens are credentials. Store server tokens in a secret manager, keep them out of URLs and logs, and never put send-capable tokens in mobile code.

Rotation

Create a replacement token with the same or narrower preset, deploy it, confirm successful requests, then revoke the old token from Application settings. Revocation is immediate.