APNs BadDeviceToken (400): Causes and Fix, Including Sandbox vs Production

Your iOS push fails with 400 and "reason": "BadDeviceToken". Before you delete that token, check one thing: is it going to the right APNs environment? Most of the time it's a sandbox token sent to production, or the other way round.

What the error looks like

APNs replies with HTTP 400 and a JSON body with the reason:

HTTP/2 400
apns-id: 5E3F9C1A-7B2D-4C8E-9A61-2F0B3D4E5A6C

{
  "reason": "BadDeviceToken"
}

Apple's description is simply that the device token is invalid. The response doesn't tell you why, so check the likely causes in order.

Cause 1: sandbox and production are mixed up

APNs has two environments, and a device token only works in the one it came from:

# Development builds (run from Xcode with a development profile)
https://api.sandbox.push.apple.com/3/device/<device-token>

# TestFlight, Ad Hoc and App Store builds
https://api.push.apple.com/3/device/<device-token>

• A build run from Xcode with a development provisioning profile has aps-environment set to development and gets sandbox tokens. So does the iOS Simulator.
• TestFlight, Ad Hoc and App Store builds are signed for distribution and get production tokens.

A typical story: push works perfectly while you test from Xcode, then every TestFlight tester gets BadDeviceToken, because the server still sends to the sandbox host. Or the reverse, after someone switches the server to production and keeps testing from Xcode.

Fix: store the environment with each token when the app uploads it (for example a sandbox flag set from your build configuration), and send each token to its matching host.

Other causes

• The token string was changed. APNs device tokens arrive as binary data. Convert them to a hexadecimal string once and store it exactly. Using description on the token, adding spaces or angle brackets, or cutting the string short all produce an invalid token.
• You sent an FCM token to APNs. If your app uses Firebase, the token from Messaging.messaging().fcmToken is an FCM token. It goes to FCM, not to APNs directly. The APNs token is the one from didRegisterForRemoteNotificationsWithDeviceToken.
• The token belongs to another app. Tokens are tied to the app that requested them. If you have several apps or bundle IDs, check that you send each token with the right one. This often shows up as DeviceTokenNotForTopic instead.

A quick way to find the cause

1. Get a fresh token from a test device and log it on the device.
2. Compare it with what your server stored, character by character.
3. Note how that build was installed: from Xcode, or through TestFlight or the App Store.
4. Send to the matching host. If it works, the problem was the environment.
5. If it still fails on the right host with an exact token, check the bundle ID and your APNs key.

How it differs from other APNs errors

Only delete a token when the error says the token itself is dead:

In code, the branching can look like this:

// reason comes from the JSON body of a non-200 APNs response
switch (reason) {
  case "Unregistered":           // 410: the token is no longer active
    await removeToken(token);
    break;
  case "BadDeviceToken":         // 400: check the environment first
    if (await isEnvironmentMismatch(token)) {
      await sendToOtherHost(token);
    } else {
      await removeToken(token);
    }
    break;
  case "DeviceTokenNotForTopic": // 400: wrong apns-topic (bundle ID)
    await fixTopicConfig();
    break;
  case "TooManyRequests":
  case "InternalServerError":
  case "ServiceUnavailable":
    await retryWithBackoff(token);
    break;
}

If you send iOS pushes through Firebase instead, APNs problems come back as FCM errors. See FCM UNREGISTERED: Requested entity was not found for that side.

On notifySphere

notifySphere delivers iOS pushes through FCM and APNs, and its React Native and Flutter SDKs register the device for you, so you don't convert or store tokens yourself. Still setting up iOS? Start with the Firebase iOS push guide, or fix No APNS token specified if you hit that first.

Frequently asked questions