---
title: Configuring push notifications on iOS
description: Configure APNs, PingOne, your iOS app, and DaVinci so the accessing device can trigger PingOne MFA push notifications that a paired iOS device can respond to.
component: orchsdks
page_id: orchsdks:davinci:use-cases/pingone-mfa/ios/06a-push-environment-setup
canonical_url: https://developer.pingidentity.com/orchsdks/davinci/use-cases/pingone-mfa/ios/06a-push-environment-setup.html
llms_txt: https://developer.pingidentity.com/orchsdks/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
keywords: ["DaVinci", "MFA", "PingOne", "iOS", "Push", "APNS", "Configuration", "SDK"]
section_ids:
  apns-setup: Setting up Apple Push Notification service
  enabling_the_push_notifications_capability: Enabling the Push Notifications capability
  creating_the_apns_authentication_key: Creating the APNs authentication key
  setting_up_pingone: Setting up PingOne
  pingone-setup: Creating the application and enabling push
  enabling_push_in_the_mfa_policy: Enabling push in the MFA policy
  davinci-setup: Setting up DaVinci
---

# Configuring push notifications on iOS

[icon: circle-check, set=far]PingOne [icon: apple, set=fab]iOS

Before your iOS app can receive and respond to PingOne MFA push notifications, complete the following configuration steps. Push notifications depend on configuration in Apple, PingOne, your iOS app, and DaVinci.

## Setting up Apple Push Notification service

Push notifications arrive through Apple Push Notification service (APNs). Two separate credentials are involved, and it is easy to confuse them:

* The **app-side** entitlement, which lets your app receive notifications. This is the Push Notifications capability you enable on your app target in Xcode.

* The **server-side** credential, which lets PingOne send notifications to your app. This is an APNs authentication key, which an administrator uploads to your PingOne application. It never goes in your app.

### Enabling the Push Notifications capability

1. In Xcode, select your app target, open **Signing & Capabilities**, and click **+ Capability**.

2. Add **Push Notifications**.

3. Also add **Background Modes** and check **Remote notifications**, so the app can process notifications delivered while it is in the background.

### Creating the APNs authentication key

For PingOne to deliver a push to your app, it authenticates to APNs with an authentication key from your Apple Developer account. An administrator creates the key:

1. In the [Apple Developer console](https://developer.apple.com/account/resources/authkeys/list), go to **Certificates, Identifiers & Profiles** > **Keys** and click **Create a key** (or the **+** button).

2. Enable **Apple Push Notifications service (APNs)**, give the key a name, and continue.

3. Download the `.p8` key file and note the **Key ID** shown next to the key.

4. Also note the following values, which the PingOne configuration in the next section needs:

   * Your team's **Team ID**, from **Membership details** in the [Apple Developer account page](https://developer.apple.com/account).

   * The app's **Bundle ID**, shown under your app target's **Signing & Capabilities** tab in Xcode, and listed as an identifier under **Certificates, Identifiers & Profiles** > **Identifiers** in the Apple Developer console. It must match in both places and in the PingOne application.

The PingOne configuration in the next section uploads this key to PingOne and uses the Key ID, Team ID, and Bundle ID.

|   |                                                                                                                                                                                                                              |
| - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | The APNs authentication key is a private credential that lets the holder send push notifications for your Apple Developer team. Do not add it to your app, commit it to source control, or include it in any build artifact. |

## Setting up PingOne

### Creating the application and enabling push

In the PingOne admin console, an administrator creates the application that represents the mobile app. The application is a **Native App (OpenID Connect)** application with a **Mobile** tab in its profile.

To create the application:

1. Log in to your PingOne administration console.

2. In the left panel, navigate to **Applications** > **Applications**.

3. Next to the **Applications** label, click the plus icon ([icon: plus, set=fa]).

   PingOne displays the **Add Application** panel.

4. In **Application Name**, enter a name for the application, for example `pingone-mfa-ios`.

5. Select **Native App (OpenID Connect)** as the **Application Type**, and then click **Save**.

6. Enable the application by using the toggle next to its name.

With the application created, configure its mobile profile:

1. Open the application and select the **Mobile** tab.

2. Under **iOS** > **Bundle ID**, enter the app's bundle identifier you noted earlier. This must exactly match the bundle identifier in your Xcode project and the one registered with Apple.

3. Under **iOS** > **Push Notifications**, add the APNs authentication key: upload the `.p8` key file and enter the **Key ID** and **Team ID** noted earlier.

4. Click **Save**.

|   |                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| - | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | The module uses the APNs sandbox environment in `DEBUG` builds and the production environment otherwise.The APNs authentication key works for both environments, but the push token the device registers differs: a `DEBUG` build registers a sandbox token, a release build registers a production token. If you test with a `DEBUG` build, make sure PingOne sends test pushes through the matching environment, otherwise delivery fails silently. |

### Enabling push in the MFA policy

The MFA policy controls which authentication methods each application can use:

1. In the PingOne admin console, open **Authentication** > **MFA**, then the **MFA Policies** page, and open the policy your sign-on flow uses.

   A new environment has a **Default MFA Policy**, so check it before creating a new one.

2. Under **Allowed Authentication Methods**, in **Mobile applications**, add the iOS application you just created, and set its method to **Push** or **OTP & Push**.

3. Keep **Allow Pairing** enabled.

4. Optionally, enable **Number Matching**, to require users to select the number on their mobile device that matches the value displayed on the accessing device.

   |   |                                                                                                                                                                      |
   | - | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
   |   | You can control how the user enters the correct number by configuring the **Number Matching Options** property on the **Mobile** tab of your application in PingOne. |

5. Click **Save**.

The result will resemble the following:

![pingone mfa policy push](../../../_images/pingone-mfa-policy-push.png)Figure 1. Configuring an MFA policy for Push notifications

## Setting up DaVinci

A DaVinci flow that runs on the accessing device sends the push notification, after the user has signed on with their first factor. Build that flow in the DaVinci admin console using the PingOne MFA connector:

1. **Find the user's devices** — add a [Read All Devices](https://docs.pingidentity.com/connectors/p1_mfa_connector.html) capability from the PingOne MFA connector. It lists the user's active MFA devices so the flow can target the push at a specific paired device rather than hoping for a default.

2. **Create the authentication request** — add a [Create Device Authentication](https://docs.pingidentity.com/connectors/p1_mfa_connector.html) capability from the PingOne MFA connector, and map the device from the Read All Devices node to its input. This is the capability that sends the push notification to the paired device.

3. **Check the result** — add a [Read Device Authentication](https://docs.pingidentity.com/connectors/p1_mfa_connector.html) capability from the PingOne MFA connector to poll the authentication transaction until it completes or times out, then branch on the result. If the transaction shows that push confirmation timed out, the flow can resend the push or fall back to another method.

If your users have several paired devices, add the PingOne MFA connector's [Device Selection](https://docs.pingidentity.com/connectors/p1_mfa_connector.html) capability between the first two capabilities so the user can choose which device receives the push.

Both the Read All Devices and Create Device Authentication capabilities have an **Application** setting that selects which PingOne application the capability acts on. Select the **Native App (OpenID Connect)** application that represents your mobile app, the same application configured in [Creating the application and enabling push](#pingone-setup).

When the flow reaches the Create Device Authentication node, PingOne sends the push notification. The Read Device Authentication node completes when your app approves or denies the request, and the flow resumes with the result.