Generate a VAPID (Voluntary Application Server Identification, RFC 8292) ECDSA P-256 key pair for Web Push — the applicationServerKey your service worker subscribes with, plus the private key your push server signs with. Generated locally with the browser's native Web Crypto API; nothing is sent anywhere.
A VAPID key pair is a standard ECDSA P-256 (secp256r1 / prime256v1) key. The public key is exported as the 65-byte uncompressed SEC1 point (0x04 || X || Y) and the private key as its raw 32-byte scalar — both base64url-encoded with no padding, exactly the format the Web Push protocol and libraries like web-push expect. Push services (Chrome, Firefox, Edge) verify a JWT you sign with the private key, proving your server sent the notification without needing a full PKI.