Notifications

Orimora notifies you when teammates act on content you care about — a document you authored is updated, someone replies to your comment, an invite is accepted, and more. Notifications are delivered over up to three independent channels.

The notification feed

The bell in the top bar shows an unread badge and the latest items; the dedicated /notifications page lists the full history with an all / unread filter. Each entry deep-links to the document, comment, or collection that triggered it. Marking one read (or mark all read) clears the badge.

Channels

Channel	Where it appears
In-app	The bell feed and /notifications page
Email	Delivered via your configured SMTP server
Web push	OS-level push to subscribed browsers/devices (PWA)

The three channels are independent: turning one off does not affect the others. Configure them under Settings → Notifications.

Toggle	Effect
In-app	Write a bell-feed entry
Email	Send an email
Push (web push)	Send a web-push notification (per account, see below)

Web push

Web push delivers notifications even when Orimora isn’t open, using the browser’s Push API.

1. Per device: the first time you enable push in a browser, you grant the notification permission and the browser registers a subscription. Each browser/device is a separate subscription — enable it on every device you want.
2. Per account: the Push toggle in Settings → Notifications is an account-wide switch. With it off, no device receives push regardless of its subscription.

Setting up web push (VAPID keys)

Web push needs the server to sign every message with a VAPID key pair (Voluntary Application Server Identification, RFC 8292). The keys identify your Orimora server to the browser push services (Mozilla autopush, Google FCM, Microsoft WNS, Apple) so they accept your messages. Until all three variables below are set, the push channel is silently disabled — the per-account toggle and the per-device Enable button have no effect, and the API reports the channel as unavailable.

Caution

VAPID_PRIVATE_KEY is a server secret — it signs your push requests. Never commit it and never expose it to the browser (only the public key is ever sent to clients). Note that Apple does not support web push for installed PWAs regardless of VAPID setup.

The three variables

Variable	Purpose
VAPID_PUBLIC_KEY	Base64url public key (~87 chars). Sent to the browser as the applicationServerKey when it subscribes. Safe to expose.
VAPID_PRIVATE_KEY	Base64url private key (~43 chars). Secret — signs every outgoing push.
VAPID_SUBJECT	A contact URI for your server: either mailto:you@example.com or https://your-domain.example. Push services use it to reach the operator; some reject a missing/malformed value.

The public and private key are a matched pair — generate them together, once per deployment, and keep them stable (see Rotating keys).

Generate a key pair

Recommended — the bundled script (offline, nothing to install; uses the project’s own web-push dependency):

node scripts/generate-vapid-keys.mjs

It prints ready-to-paste .env lines.

Alternative — the web-push CLI:

npx web-push generate-vapid-keys

Online generators (convenience, no local tooling): browser-based tools such as vapidkeys.com or Google’s Web Push Codelab.

Caution

Prefer generating the pair locally with one of the commands above — a private key pasted from a third-party website has left your control, however briefly. If you must use an online generator, only use HTTPS tools and rotate to a locally-generated key before production.

Set and apply

Paste the values into your .env (or secrets manager) and restart the app:

VAPID_PUBLIC_KEY=BMxxxxxxxx…            # public — safe to expose
VAPID_PRIVATE_KEY=k3Fxxxxxxx…           # SECRET — keep server-side
VAPID_SUBJECT=mailto:admin@your-domain.example

On Coolify, add all three as runtime environment variables and Force Rebuild (not just Restart) — see Coolify.

Verify

Open Settings → Notifications. With the keys set, the Push toggle becomes effective; enable push on the device, then use Send test to deliver a synthetic notification to your subscribed browsers. If the keys are missing, Send test returns a “Web Push is not configured” error and the per-account toggle stays inert.

Rotating keys

Replacing the VAPID pair invalidates every existing browser subscription — users must re-enable web push on each device afterwards. Rotate only when the private key may be exposed, and tell your users to re-enable. The keys are not tied to your domain, so moving Orimora to a new domain does not require new keys.

Mute specific events

Under Settings → Notifications → Mute specific events, silence individual event types (e.g. document updated, member joined) across all channels. Muting a type stops in-app, email, and push for that type while leaving the others active.

Notification types include document updated / published / mentioned, collection updated, invite accepted, member joined, required-document assigned, new comment / comment reply, and gamification events (badge earned, level up, streak milestone).

External integrations (webhooks)

Every in-app notification also emits a notification.created event on the team’s event bus, which can fan out to webhooks (n8n, Zapier, Slack/Telegram bots, …). See Webhooks — note the higher volume of this event type.