From 1c9887e0dfca86985b06269fb20d4438623a01f6 Mon Sep 17 00:00:00 2001
From: linus <linusmaximilian08@gmail.com>
Date: Thu, 10 Sep 2026 11:57:07 +0200
Subject: [PATCH] chore(client): set FCM web-push VAPID key (public)

Client push-token acquisition is now fully configured; a real browser
session (logged-in user granting notification permission) is needed to
mint the first token. Backend delivery still needs the service-account JSON.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 client/app/web/index.html | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/client/app/web/index.html b/client/app/web/index.html
index a49b314..24c2b97 100644
--- a/client/app/web/index.html
+++ b/client/app/web/index.html
@@ -32,10 +32,9 @@
   <title>KC-App</title>
   <link rel="manifest" href="manifest.json">
 
-  <!-- Firebase Cloud Messaging (web push). vapidKey still needs the Web Push
-       certificate key pair (Project settings > Cloud Messaging > Web config).
-       Until it's set kcGetPushToken() returns null and the app runs without
-       push. -->
+  <!-- Firebase Cloud Messaging (web push). `vapidKey` is the *public* half of
+       the Web Push certificate key pair; the private half stays in Firebase.
+       Backend sending still needs a service-account JSON + PUSH_PROVIDER=fcm. -->
   <script src="https://www.gstatic.com/firebasejs/10.13.2/firebase-app-compat.js"></script>
   <script src="https://www.gstatic.com/firebasejs/10.13.2/firebase-messaging-compat.js"></script>
   <script>
@@ -47,7 +46,7 @@
       messagingSenderId: "307226979593",
       appId: "1:307226979593:web:66898b2c78b2d110ef77d8",
       measurementId: "G-NK8K5VV40D",
-      vapidKey: "REPLACE_ME"
+      vapidKey: "BEAHrnIzkTBGSEws1J_HRvsTtc6nqvmW4MvFMTfljmjuunqo4yiJoUcq8_jKIt_hbm4diOt0czG28l-dpvGK8T8"
     };
     window.kcGetPushToken = async function () {
       try {