Web push

A site registers a service worker and calls the Push API, and the browser asks the visitor for permission. The browser returns a subscription (a push service URL plus encryption keys) that the site stores on its server. To notify, the server sends an encrypted message to that URL, signed with the site's VAPID key pair; the browser maker's push service delivers it, and the service worker shows the notification.

It works in Chrome, Edge, Firefox and Safari. On iPhone and iPad (iOS 16.4 and later) it only works for sites the user has added to the Home Screen as a web app. Browsers expect the permission request to follow a click rather than appear on page load, and libraries such as web-push for Node.js handle the encryption and signing.