diff --git a/config/config.go b/config/config.go
index 01771cd..d3463d0 100644
--- a/config/config.go
+++ b/config/config.go
@@ -19,6 +19,8 @@ var Config struct {
 	MipushKeyPath      string `env:"MIPUSH_KEY_PATH" envDefault:"data/mipush.pem"`
 	APNSKeyPath        string `env:"APNS_KEY_PATH" envDefault:"data/apns.pem"`
 	APNSKeyPathV2      string `env:"APNS_KEY_PATH_V2" envDefault:"data/apns_v2.p8"`
+	APNSKeyPassword    string `env:"APNS_KEY_PASSWORD" envDefault:""`
+	APNSKeyPasswordV2  string `env:"APNS_KEY_PASSWORD_V2" envDefault:""`
 	IOSPackageName     string `env:"IOS_PACKAGE_NAME" envDefault:"io.github.danxi-dev.dan-xi"`
 	IOSPackageNameV2   string `env:"IOS_PACKAGE_NAME_V2" envDefault:"com.fduhole.danxi"`
 	AndroidPackageName string `env:"ANDROID_PACKAGE_NAME" envDefault:"io.github.danxi_dev.dan_xi"`
diff --git a/push/apns/init.go b/push/apns/init.go
index 006e01e..d5cf342 100644
--- a/push/apns/init.go
+++ b/push/apns/init.go
@@ -16,34 +16,36 @@ var clientV2 *apns2.Client
 
 func init() {
 	// init apns for DanXi v1
-	initAPNS(config.Config.APNSKeyPath, &client)
+	client = newAPNSClient(config.Config.APNSKeyPath, config.Config.APNSKeyPassword)
 
 	// init apns for DanXi v2
-	initAPNS(config.Config.APNSKeyPathV2, &clientV2)
+	clientV2 = newAPNSClient(config.Config.APNSKeyPathV2, config.Config.APNSKeyPasswordV2)
 }
 
-// initAPNS init apns
-func initAPNS(path string, client **apns2.Client) {
+// newAPNSClient create apns client from cert file and password
+func newAPNSClient(path string, password string) (client *apns2.Client) {
 	var (
 		err  error
 		cert tls.Certificate
 	)
 
 	if strings.HasSuffix(path, ".p12") {
-		cert, err = certificate.FromP12File(path, "")
+		cert, err = certificate.FromP12File(path, password)
 	} else {
-		cert, err = certificate.FromPemFile(path, "")
+		cert, err = certificate.FromPemFile(path, password)
 	}
 
 	if err != nil {
 		log.Warn().Err(err).Str("scope", "init APNs").Msg("APNs cert error")
-		return
+		return nil
 	}
 	if config.Config.Mode == "dev" {
-		*client = apns2.NewClient(cert).Development()
+		client = apns2.NewClient(cert).Development()
 		log.Debug().Msg("init apns; use development mode")
 	} else {
-		*client = apns2.NewClient(cert).Production()
+		client = apns2.NewClient(cert).Production()
 		log.Debug().Msg("init apns; use production mode")
 	}
+
+	return
 }