BadEnvironmentKeyInToken points to the .p8 key, not to your token or App ID. Since Apple added team-scoped and topic-specific keys, every APNs key has an Environment setting (Sandbox, Production, or Sandbox & Production), and you can't change it after the key is created. Your results match a sandbox-only key: production refuses the key (403), while sandbox accepts the key but rejects your production token (400 BadDeviceToken). Fix: Go to Certificates, Identifiers & Profiles > Keys, open the key and check its APNs environment. If it is Sandbox only, create a new key with APNs enabled, click Configure and choose Environment "Sandbox & Production" (or "Production"). For Key Restriction, pick Team Scoped or your bundle ID. Update the Key ID and .p8 on your server (and in Firebase, if you use it), wait a few minutes, then resend to api.push.apple.com. To check the token without involving the key, you can send one push using a Production APNs certificate (.p12) instead. I'm the developer of Push Notification Tester, a free Mac app that does exactly this: https://apps.apple.com/us/app/push-notification-tester/id1516154713