APNs push configuration mismatch between local development and production distribution

Answer

The APNs endpoint and credential that must be used are dictated by the aps-environment entitlement embedded in the provisioning profile that signs the app. A development profile carries aps-environment = development and requires the sandbox endpoint (api.sandbox.push.apple.com) together with a development certificate or the APNs key configured for the sandbox. A distribution (Ad Hoc, TestFlight, App Store) profile carries aps-environment = production and must use the production endpoint (api.push.apple.com) with a distribution certificate or the same APNs key but uploaded for the production environment.

Likely explanation

If the entitlement says development while your push server targets api.push.apple.com (or uses a production certificate), APNs will reject the device token as invalid for that environment, resulting in silent drops or an InvalidToken error. Conversely, a production‑signed app talking to the sandbox endpoint will also be rejected because the token namespace does not match.

Confirmed facts

• APNs validates the combination of bundle ID, authentication method (certificate or key), and environment against the aps-environment entitlement.
• A single APNs authentication key (team key) can be used for both sandbox and production, but the key must be registered separately for each environment on your push provider; the same key value works, but the provider must select the appropriate APNs host and indicate the environment when sending.
• The Push Notifications entitlement itself does not change token registration; it only signals which environment the app expects. The device token obtained from registerForRemoteNotifications will be a sandbox token when the entitlement is development and a production token when it is production.

Steps needed for this case

1. Inspect the entitlements of the distribution build:

   codesign --display --entitlements - /Path/to/YourApp.app

   Look for <key>aps-environment</key><string>production</string>.
2. Confirm that your push server is configured to use api.push.apple.com (not the sandbox host) and that the credential uploaded matches the production environment (distribution certificate or the APNs key marked for production).
3. Send a test push (e.g., via curl) to the production endpoint with the production token obtained from a device running the distribution build; a 200 response confirms correct pairing.

Missing diagnostic detail

To verify that the mismatch is indeed the cause, please share the exact error code or response you receive from APNs when attempting a production push (e.g., InvalidToken, BadDeviceToken, or HTTP status). This will confirm whether the environment/credential pairing is the issue.