ntfy vs OneSignal

ntfy

Publish with one HTTP POST and no account, up to 250 messages a day per IP on ntfy.sh. Unreserved topics on ntfy.sh can be read and written by anyone who knows the name.

OneSignal

Runs push delivery itself, so there's no separate push provider to wire up. Three incidents on the API and SDK endpoints in September 2026.

ntfy

1. Use a long random topic name, or a reserved topic with a Bearer token
2. Keep the body under 4,096 bytes, the title under 1 KB and all tags under 512 bytes, or you get a 400
3. Don't blind-retry a publish. There's no idempotency key, so the person gets it twice
4. Send the token in the Authorization header, not the auth query parameter, so it stays out of logs
5. Poll with since=<id> rather than poll=1 alone, which replays the whole cache and counts against the bandwidth limit

OneSignal

1. Use Authorization: Key <key>, not Bearer, and put app_id in the body
2. Send an idempotency_key UUID with every create call and reuse it on each retry
3. On 429, wait for Retry-After, then back off with jitter, up to 10 attempts
4. Stay under 10 sends per subscribed subscription in 15 minutes or the app is disabled
5. Target people with include_aliases.external_id and set target_channel