Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix Auto-generated VAPID keys use @localhost subject, breaking Apple Web Push (iOS PWA)

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

Root Cause

Apple requires the VAPID JWT sub claim to be a valid email domain (like mailto:[email protected]) or a valid URL (like https://host.example.com). @localhost is not considered valid by Apple's validation. Mozilla/Firefox push service has the same requirement.

Fix Action

Workaround

Manually edit ~/.openclaw/push/vapid-keys.json and change "subject" to a real email address, then re-subscribe from the PWA.

RAW_BUFFERClick to expand / collapse

Version

OpenClaw 2026.5.12 (f066dd2)

Problem

The Gateway auto-generates VAPID keys in push/vapid-keys.json with the subject mailto:openclaw@localhost. Apple's Web Push service (used by Safari/iOS PWAs) rejects JWTs signed with this subject, returning 403 BadJwtToken.

This means iOS PWA push notifications silently fail for all OpenClaw users.

Root Cause

Apple requires the VAPID JWT sub claim to be a valid email domain (like mailto:[email protected]) or a valid URL (like https://host.example.com). @localhost is not considered valid by Apple's validation. Mozilla/Firefox push service has the same requirement.

Verification

Tested with web-push 3.6.7 against web.push.apple.com:

  • mailto:openclaw@localhost → 403 BadJwtToken ❌
  • mailto:[email protected] → 201 ✅
  • https://sd6-server.tail5ffe17.ts.net → 201 ✅

Workaround

Manually edit ~/.openclaw/push/vapid-keys.json and change "subject" to a real email address, then re-subscribe from the PWA.

Suggested Fix

  1. Add a configurable push.vapid.subject field to openclaw.json so users can set a real email/URL
  2. Auto-detect a better subject from the Tailscale domain (https://<host>.ts.net) or hostname
  3. At minimum: log a warning when the VAPID subject is @localhost, alerting that iOS push will not work

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#inference speed#output truncation#response parsing#generation error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - 💡(How to fix) Fix Auto-generated VAPID keys use @localhost subject, breaking Apple Web Push (iOS PWA)