Browser push notifications, as an API you own.
Creator Notify turns browser push into two calls: one to collect subscriptions, one to send a notification. No dashboard to log into, no extension to install, no vendor holding your subscriber list. Create an account, copy your two keys, and call it from PHP, Node, Python — anything that can make an HTTPS request.
One endpoint to publish
Authenticate with your website's secret key, POST a JSON body, get a structured delivery report back. The audience is derived from the key — a website can only ever notify its own subscribers.
- Server-side only. The secret key never touches the browser.
- Bounded concurrency. Delivery is batched; large audiences continue asynchronously.
- Honest reporting. Accepted counts, failures and invalidated subscriptions are separate numbers.
Authorization: Bearer cn_live_<your secret key>
Content-Type: application/json
{
"title": "Special discount",
"body": "10% off for the next 10 hours.",
"url": "https://example.com/offers",
"tag": "special-discount",
"data": { "campaign": "discount-2026" }
}
// 200 OK
{
"success": true,
"notification_id": "ntf_...",
"accepted_subscriptions": 1432,
"successful_submissions": 1398,
"failed_submissions": 21,
"invalid_subscriptions": 13
}How it fits together
Four moving parts, each replaceable and each documented.
POST /v1/sites/register returns a public identifier and a secret key. Store the key in your server's environment.
The SDK registers your Service Worker, asks permission after a click, and posts the push subscription to the API.
Your admin panel calls POST /v1/notifications with the secret key. Web Push (VAPID) delivers it.
Publish at least once every seven days, or the registration expires and stops accepting notifications.
// 1. get a public id + secret key
curl -X POST https://YOUR-API-HOST/v1/sites/register \
-H 'Content-Type: application/json' \
-d '{"name":"My Site","contact_email":"you@example.com","origin":"https://example.com"}'
// 2. collect subscriptions (browser)
<button id="enable">Enable notifications</button>
<script src="/creator-notify.js"></script>
<script>
const notify = new CreatorNotify({
websiteId: "pub_...",
apiBaseUrl: "https://YOUR-API-HOST"
});
enable.onclick = () => notify.subscribe();
</script>
// 3. publish from your server (PHP, Node, ...)
curl -X POST https://YOUR-API-HOST/v1/notifications \
-H "Authorization: Bearer $CREATOR_NOTIFY_KEY" \
-d '{"title":"Hello","body":"World"}'Built for people who read the source
Small surface area, explicit failure modes, no hidden state.
Plain REST + JSON
Predictable routes, stable error codes and a machine-readable index at GET /v1.
Multi-tenant by construction
Tenant identity comes from a hashed API key, never from the request body. Cross-tenant access has no code path.
Seven-day inactivity rule
Registrations that stop publishing expire automatically — enforced by a scheduled sweep and again on every request.
Bounded delivery
Large audiences are sent in pages with limited parallelism, never as one unbounded fan-out.
Hashed keys, encrypted secrets
API keys are stored as peppered hashes; subscription auth secrets are sealed with AES-256-GCM.
Delivery you can audit
Every attempt is recorded per subscription with HTTP status and error code, subject to a retention policy.
Expiration, honestly explained
An expired registration means the website owner stopped publishing for the configured
window (seven days by default). Publishing returns SITE_EXPIRED until you call
POST /v1/sites/reactivate; your subscriber list is untouched.
An expired subscription is different: the browser or push service dropped that endpoint.
Those rows are marked invalid on the first 404/410 response and are never sent to again.
Security posture
- No trust in Origin headers. Origins restrict browser calls; they never authorize writes.
- Rotate and revoke.
rotate-keymints a new secret,revoke-keysuspends the registration. - Rate limits that hold. Enforced per scope and per tenant, with
Retry-Afteron every 429. - Fail closed. Errors never include stack traces, keys, endpoints or SQL.
Questions people actually ask
Short answers, all of them checkable in the source or in the API reference.
How do I send browser push notifications without building the whole stack?
Register your website, put the public key in your page so visitors can subscribe, then call
POST /v1/notifications from your server with the secret key. The API
handles VAPID signing, encryption, delivery and retries — you never touch the push-service protocols.
Is Creator Notify free?
Yes. The source is MIT licensed, this instance is free to use, and you can self-host the same code. There is no paid tier in this codebase.
Which browsers support it?
Any browser that implements the Web Push standard — current Chrome, Edge, Firefox and Safari. On iOS, push works for sites the user adds to the home screen; that is an Apple platform rule, not a limit of this API.
Can it tell me whether someone saw or opened a notification?
No, and neither can any Web Push provider. A push service confirms that it accepted the message for delivery. Creator Notify records that acceptance per subscription and never claims delivery or read receipts.
What happens if I stop sending?
A registration expires after seven days without a successful publish. Publishing is then refused until
you call POST /v1/sites/reactivate, which keeps the same keys and the whole
history. Expiry never deletes notification records.
Do I need a dashboard?
No. There is nothing to log into: the API, a rendered status page and the documentation are the whole surface. Everything is callable from your own admin panel or scripts.
Open source, no asterisks
Creator Notify is MIT licensed. There is no telemetry, no tracking and no mandatory SaaS dashboard: your admin panel is the dashboard. Read the source, audit it, and keep your subscriber list on your own terms.