I've added another comment in reply below (I couldn't keep it within the 500 char limit to put it in here)

Sort of - It calls it when a user logs in, or if the user has previously declined notifications and has since changed that permission in the OS settings

Thank you, I've resolved the issue with getting the error InvalidTokenProvider and am now getting a success response. However, the push notification is never shown on the device. I've tested this in the CloudKit console as well - it says successfully delivered to the target device but never appears. Do you know how/why this could happen? An apns-id of one of the CloudKit tests is 5263dd23-368a-40c4-8ec8-0c35dd151474