diff --git a/keyserver/src/push/providers.js b/keyserver/src/push/providers.js
--- a/keyserver/src/push/providers.js
+++ b/keyserver/src/push/providers.js
@@ -80,6 +80,14 @@
   return codeVersion && codeVersion >= 87 ? 'app.comm' : 'org.squadcal.app';
 }
 
+type WebPushConfig = { +publicKey: string, +privateKey: string };
+async function getWebPushConfig(): Promise<?WebPushConfig> {
+  return await importJSON<WebPushConfig>({
+    folder: 'secrets',
+    name: 'web_push_config',
+  });
+}
+
 export {
   getAPNPushProfileForCodeVersion,
   getFCMPushProfileForCodeVersion,
@@ -88,4 +96,5 @@
   endFirebase,
   endAPNs,
   getAPNsNotificationTopic,
+  getWebPushConfig,
 };
diff --git a/keyserver/src/responders/website-responders.js b/keyserver/src/responders/website-responders.js
--- a/keyserver/src/responders/website-responders.js
+++ b/keyserver/src/responders/website-responders.js
@@ -40,6 +40,7 @@
   fetchCurrentUserInfo,
   fetchKnownUserInfos,
 } from '../fetchers/user-fetchers.js';
+import { getWebPushConfig } from '../push/providers.js';
 import { setNewSession } from '../session/cookies.js';
 import { Viewer } from '../session/viewer.js';
 import { streamJSON, waitForStream } from '../utils/json-stream.js';
@@ -301,6 +302,17 @@
     return hasNotAcknowledgedPolicies ? 0 : initialTime;
   })();
 
+  const pushApiPublicKeyPromise = (async () => {
+    const pushConfig = await getWebPushConfig();
+    if (!pushConfig) {
+      if (process.env.NODE_ENV !== 'development') {
+        console.warn('keyserver/secrets/web_push_config.json should exist');
+      }
+      return null;
+    }
+    return pushConfig.publicKey;
+  })();
+
   const { jsURL, fontsURL, cssInclude } = await assetInfoPromise;
 
   // prettier-ignore
@@ -386,6 +398,7 @@
     windowActive: true,
     userPolicies: {},
     primaryIdentityPublicKey: null,
+    pushApiPublicKey: pushApiPublicKeyPromise,
     _persist: null,
   });
   const jsonStream = streamJSON(res, initialReduxState);
diff --git a/lib/types/redux-types.js b/lib/types/redux-types.js
--- a/lib/types/redux-types.js
+++ b/lib/types/redux-types.js
@@ -121,6 +121,7 @@
   deviceToken?: void,
   cookie?: void,
   primaryIdentityPublicKey: ?string,
+  pushApiPublicKey: ?string,
   ...
 };
 export type AppState = NativeAppState | WebAppState;
diff --git a/web/redux/redux-setup.js b/web/redux/redux-setup.js
--- a/web/redux/redux-setup.js
+++ b/web/redux/redux-setup.js
@@ -81,6 +81,7 @@
   windowActive: boolean,
   userPolicies: UserPolicies,
   primaryIdentityPublicKey: ?string,
+  pushApiPublicKey: ?string,
   _persist: ?PersistState,
 };