diff --git a/services/tunnelbroker/src/notifs/web_push/mod.rs b/services/tunnelbroker/src/notifs/web_push/mod.rs
--- a/services/tunnelbroker/src/notifs/web_push/mod.rs
+++ b/services/tunnelbroker/src/notifs/web_push/mod.rs
@@ -8,7 +8,7 @@
 use crate::notifs::web_push::config::WebPushConfig;
 
 pub mod config;
-mod error;
+pub mod error;
 
 #[derive(Serialize, Deserialize)]
 pub struct WebPushNotif {
diff --git a/services/tunnelbroker/src/websockets/session.rs b/services/tunnelbroker/src/websockets/session.rs
--- a/services/tunnelbroker/src/websockets/session.rs
+++ b/services/tunnelbroker/src/websockets/session.rs
@@ -30,15 +30,14 @@
 use crate::notifs::apns::response::ErrorReason;
 
 use crate::database::{self, DatabaseClient, MessageToDeviceExt};
-use crate::identity;
-use crate::notifs::apns::error::Error;
 use crate::notifs::apns::headers::NotificationHeaders;
 use crate::notifs::apns::APNsNotif;
 use crate::notifs::fcm::firebase_message::{
   AndroidConfig, AndroidMessagePriority, FCMMessage,
 };
 use crate::notifs::web_push::WebPushNotif;
-use crate::notifs::{NotifClient, NotifClientType};
+use crate::notifs::{apns, NotifClient, NotifClientType};
+use crate::{identity, notifs};
 
 pub struct DeviceInfo {
   pub device_id: String,
@@ -423,7 +422,7 @@
 
         if let Some(apns) = self.notif_client.apns.clone() {
           let response = apns.send(apns_notif).await;
-          if let Err(Error::ResponseError(body)) = &response {
+          if let Err(apns::error::Error::ResponseError(body)) = &response {
             if matches!(
               body.reason,
               ErrorReason::BadDeviceToken
@@ -431,10 +430,13 @@
                 | ErrorReason::ExpiredToken
             ) {
               if let Err(e) = self
-                .invalidate_device_token(notif.device_id, device_token)
+                .invalidate_device_token(notif.device_id, device_token.clone())
                 .await
               {
-                error!("Error invalidating device token: {:?}", e);
+                error!(
+                  "Error invalidating device token {}: {:?}",
+                  device_token, e
+                );
               };
             }
           }
@@ -520,7 +522,7 @@
         };
 
         let device_token = match self
-          .get_device_token(notif.device_id, NotifClientType::WebPush)
+          .get_device_token(notif.device_id.clone(), NotifClientType::WebPush)
           .await
         {
           Ok(token) => token,
@@ -533,11 +535,30 @@
         };
 
         let web_push_notif = WebPushNotif {
-          device_token,
+          device_token: device_token.clone(),
           payload: notif.payload,
         };
 
         let result = web_push_client.send(web_push_notif).await;
+        if let Err(notifs::web_push::error::Error::WebPush(web_push_error)) =
+          &result
+        {
+          if matches!(
+            web_push_error,
+            web_push::WebPushError::EndpointNotValid
+              | web_push::WebPushError::EndpointNotFound
+          ) {
+            if let Err(e) = self
+              .invalidate_device_token(notif.device_id, device_token.clone())
+              .await
+            {
+              error!(
+                "Error invalidating device token {}: {:?}",
+                device_token, e
+              );
+            };
+          }
+        }
         Some(
           self.get_message_to_device_status(&notif.client_message_id, result),
         )