diff --git a/services/tunnelbroker/src/config.rs b/services/tunnelbroker/src/config.rs
--- a/services/tunnelbroker/src/config.rs
+++ b/services/tunnelbroker/src/config.rs
@@ -1,7 +1,8 @@
 use crate::constants;
-use crate::constants::{ENV_APNS_CONFIG, ENV_FCM_CONFIG};
+use crate::constants::{ENV_APNS_CONFIG, ENV_FCM_CONFIG, ENV_WEB_PUSH_CONFIG};
 use crate::notifs::apns::config::APNsConfig;
 use crate::notifs::fcm::config::FCMConfig;
+use crate::notifs::web_push::config::WebPushConfig;
 use anyhow::{ensure, Result};
 use clap::Parser;
 use comm_lib::aws;
@@ -37,6 +38,10 @@
   #[arg(env = ENV_FCM_CONFIG)]
   #[arg(long)]
   pub fcm_config: Option<FCMConfig>,
+  /// Web Push secrets
+  #[arg(env = ENV_WEB_PUSH_CONFIG)]
+  #[arg(long)]
+  pub web_push_config: Option<WebPushConfig>,
 }
 
 /// Stores configuration parsed from command-line arguments
diff --git a/services/tunnelbroker/src/main.rs b/services/tunnelbroker/src/main.rs
--- a/services/tunnelbroker/src/main.rs
+++ b/services/tunnelbroker/src/main.rs
@@ -69,7 +69,13 @@
     }
   };
 
-  let notif_client = NotifClient { apns, fcm };
+  let web_push_config = CONFIG.web_push_config.clone();
+
+  let notif_client = NotifClient {
+    apns,
+    fcm,
+    web_push: None,
+  };
 
   let grpc_server = grpc::run_server(db_client.clone(), &amqp_connection);
   let websocket_server = websockets::run_server(
diff --git a/services/tunnelbroker/src/notifs/mod.rs b/services/tunnelbroker/src/notifs/mod.rs
--- a/services/tunnelbroker/src/notifs/mod.rs
+++ b/services/tunnelbroker/src/notifs/mod.rs
@@ -1,11 +1,14 @@
 use crate::notifs::apns::APNsClient;
 use crate::notifs::fcm::FCMClient;
+use crate::notifs::web_push::WebPushClient;
 
 pub mod apns;
 pub mod fcm;
+pub mod web_push;
 
 #[derive(Clone)]
 pub struct NotifClient {
   pub(crate) apns: Option<APNsClient>,
   pub(crate) fcm: Option<FCMClient>,
+  pub(crate) web_push: Option<WebPushClient>,
 }
diff --git a/services/tunnelbroker/src/notifs/web_push/config.rs b/services/tunnelbroker/src/notifs/web_push/config.rs
new file mode 100644
--- /dev/null
+++ b/services/tunnelbroker/src/notifs/web_push/config.rs
@@ -0,0 +1,15 @@
+use serde::{Deserialize, Serialize};
+use std::str::FromStr;
+
+#[derive(clap::Args, Clone, Debug, Deserialize, Serialize)]
+pub struct WebPushConfig {
+  pub public_key: String,
+  pub private_key: String,
+}
+
+impl FromStr for WebPushConfig {
+  type Err = serde_json::Error;
+  fn from_str(s: &str) -> Result<Self, Self::Err> {
+    serde_json::from_str(s)
+  }
+}
diff --git a/services/tunnelbroker/src/notifs/web_push/mod.rs b/services/tunnelbroker/src/notifs/web_push/mod.rs
new file mode 100644
--- /dev/null
+++ b/services/tunnelbroker/src/notifs/web_push/mod.rs
@@ -0,0 +1,6 @@
+pub mod config;
+
+#[derive(Clone)]
+pub struct WebPushClient {
+  http_client: reqwest::Client,
+}