Why is my iOS platform disabled due to an "InvalidProviderToken" error, and how can I fix it?

Question: My iOS platform was disabled with an InvalidProviderToken error. What causes this, and how do I get push notifications working again?

Answer: InvalidProviderToken comes from Apple, not from Pushwoosh. APNs returns it when the provider token we present is not valid or its signature cannot be verified — in practice, when the APNs authentication key (.p8) configured for your application is wrong, expired, revoked in your Apple Developer account, or paired with a mismatched Key ID, Team ID or Bundle ID.

Because every send attempt fails while that is true, Pushwoosh disables the iOS platform for the application rather than keep hammering APNs with requests that cannot succeed. Delivery resumes once you upload a valid key and re-enable the platform.

Common causes

• The .p8 key was revoked or deleted in the Apple Developer account — often by someone else on the team.
• The uploaded key does not have APNs enabled among its key services.
• The Key ID does not belong to the uploaded .p8 file (a frequent copy-paste slip when several keys exist).
• The Team ID or Bundle ID does not match the app the key was issued for.
• The wrong gateway is selected — a Sandbox build cannot be reached through the Production gateway, or vice versa.

Step 1. Generate a new APNs key in your Apple Developer account

1. Log in to your Apple Developer account and open the Keys section in the left-hand menu. Press + to create a new key.
2. Give the key a name in Key Description, enable APNs under Key Services, and click Continue.
3. Copy the Key ID — a 10-character string — and download the authentication token signing key, the file with the .p8 extension.

Apple lets you download a .p8 file once. If you cannot find the original file, do not try to reuse it — create a new key instead.

Step 2. Upload the key to your Pushwoosh project

1. In your Pushwoosh project, go to Configure Platforms and click Configure next to the iOS platform.
2. Choose Token-based manual configuration and click Next.
3. Paste the Key ID into its field.
4. Upload the .p8 signing key in the Auth Key field.
5. Enter your Apple Developer Team ID and your Bundle ID.
6. Select the appropriate gateway, Sandbox or Production.
7. Click Configure.

Your Team ID is in the Membership section of your Apple Developer account. Your Bundle ID is in Certificates, Identifiers & Profiles, and it has to match the bundle identifier the app actually ships with.

Step 3. Confirm delivery works again

Send a test push, or target a message at one specific device, and check the message report. A successful send confirms the new key is accepted by APNs; another InvalidProviderToken means one of the four values above still does not match — re-check the Key ID against the key you actually uploaded first, since that is the most common culprit.

For the full walkthrough with screenshots, see iOS token-based configuration in the Pushwoosh documentation.