Version

OpenClaw 2026.5.12 (f066dd2)

Problem

The Gateway auto-generates VAPID keys in push/vapid-keys.json with the subject mailto:openclaw@localhost. Apple's Web Push service (used by Safari/iOS PWAs) rejects JWTs signed with this subject, returning 403 BadJwtToken.

This means iOS PWA push notifications silently fail for all OpenClaw users.

Root Cause

Apple requires the VAPID JWT sub claim to be a valid email domain (like mailto:user@gmail.com) or a valid URL (like https://host.example.com). @localhost is not considered valid by Apple's validation. Mozilla/Firefox push service has the same requirement.

Verification

Tested with web-push 3.6.7 against web.push.apple.com:

• mailto:openclaw@localhost → 403 BadJwtToken ❌
• mailto:axis823@gmail.com → 201 ✅
• https://sd6-server.tail5ffe17.ts.net → 201 ✅

Workaround

Manually edit ~/.openclaw/push/vapid-keys.json and change "subject" to a real email address, then re-subscribe from the PWA.

Suggested Fix

1. Add a configurable push.vapid.subject field to openclaw.json so users can set a real email/URL
2. Auto-detect a better subject from the Tailscale domain (https://<host>.ts.net) or hostname
3. At minimum: log a warning when the VAPID subject is @localhost, alerting that iOS push will not work