getting TooManyProviderTokenUpdates error in production for applet wallet notifications

Question

ajith19 OP

Created Sep ’23

Replies 1

Boosts 0

Participants 2

Hi All,

Product information Our product create and update apple wallet passes per client. For example, client A will have a passtypeidentifier and devices which download the same will have its devicetoken[pushtoken] registered to our database. Same for other clients as well.

We had been using legacy binary protocol-based approach till 2021, and we migrated http2 based APNS API implementation in the same year.

But past few months, we are getting TooManyProviderTokenUpdates 429 in the production environment. No such error occurring in our lower environment with the same build. We use separate p8 cert,key and teamId per environment.

*Implementation we have total of 5 clients, i.e: 5 pass type identifiers. In our current implementation , we create 5 connections per client. hence 5 oauth token[which refreshes only after 20 mins] are created. As we are sending push notifications to Apple wallet passes, we send apns-id as passtypeidentifier , no payload in the body and uses https://api.push.apple.com/3/devies/[pushtoken] endpoint for sending push notifications. So, each connection will have passtypeidentifier defined in the aps-id and device token sent in the URL.

We initially suspected, multiple connection for a team identifier would be an issue. So, in our lower region[never reported this error], we tested a new build which implements 1 single connection for all the clients and one Oauth token is being used. In this approach , pass gets updated on the devices, but no notification banner displayed on the devices. So,we reverted to production build and sent notification to those same devices, we found passes updated and notification banner appeared.

We are totally confused with the error message and behavior of APNS. Any suggestions or solution would be appreciated.

Boost

Answer 1

Engineer OP

Apple

Sep ’23

The TooManyProviderTokenUpdates is not a mysterious error. It simply means that you have changed your provider token (JWT) faster than the allowed 20 minutes. While 20 minutes is the minimum cutoff, the preferred duration is close to 60 minutes. If you are hitting this error intermittently and your token change tome is exactly 20 minutes, this could be due to propagation delays, latency in the relaying, etc.

A number of additional points to be careful about: 1- APNs expects developers to use the same authentication token for as close to one hour as possible. A good logic would be to generate a new token if the existing one is older than an hour. You may find that 20 minutes will be too soon.

2- I am not sure I understand your setup here with 5 clients, multiple teams and p8's etc., but If you use multiple TeamID’s on the same server, and generating tokens on the same connection you will receive this error as well. You need to use separate connections for each team, even if from the same physical server.

3- Authentication tokens for more than one team on the same connection is not supported. When the push server is shared by multiple apps, or in your case multiple passes, instead of using the same connection pool to send the push requests you should isolate the connection pool for each client.

So, this is either due to a timing problem, so extending the recreation of a new JWT further than 20 minutes should help. Or it is due to sharing the same connection with multiple clients, in which case creating a new connection for each client (can still use the same JWT) should help.

0