diff --git a/.gitignore b/.gitignore
index 211f1ac..4de48a7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -25,3 +25,4 @@ erl_crash.dump
 # Ignore package tarball (built via "mix hex.build").
 tusker_push-*.tar
 
+*.secret.exs
diff --git a/config/dev.exs b/config/dev.exs
index 9185853..113515c 100644
--- a/config/dev.exs
+++ b/config/dev.exs
@@ -61,3 +61,5 @@ config :phoenix, :stacktrace_depth, 20
 
 # Initialize plugs at runtime for faster development compilation
 config :phoenix, :plug_init_mode, :runtime
+
+import_config "dev.secret.exs"
diff --git a/lib/tusker_push.ex b/lib/tusker_push.ex
index e5bbfde..2deb3d2 100644
--- a/lib/tusker_push.ex
+++ b/lib/tusker_push.ex
@@ -19,7 +19,7 @@ defmodule TuskerPush do
   end
 
   @spec unregister(String.t()) :: :ok | {:error, :no_registration | Ecto.Changeset.t()}
-  def unregister(id) do
+  def unregister(id) when is_binary(id) do
     with registration when not is_nil(registration) <- Repo.get(Registration, id),
          {:ok, _} <- Repo.delete(registration) do
       :ok
@@ -31,4 +31,23 @@ defmodule TuskerPush do
         {:error, reason}
     end
   end
+
+  @spec unregister(Registration.t()) :: :ok | {:error, Ecto.Changeset.t()}
+  def unregister(%Registration{} = registration) do
+    case Repo.delete(registration) do
+      {:ok, _} -> :ok
+      {:error, reason} -> {:error, reason}
+    end
+  end
+
+  @spec get_registration(String.t()) :: Registration.t() | nil
+  def get_registration(id) do
+    Repo.get(Registration, id)
+  end
+
+  @spec check_registration_expired(Registration.t()) :: :ok | {:expired, Registration.t()}
+  def check_registration_expired(_registration) do
+    # TODO: expiration & grace period
+    :ok
+  end
 end
diff --git a/lib/tusker_push_web/controllers/push_controller.ex b/lib/tusker_push_web/controllers/push_controller.ex
new file mode 100644
index 0000000..d865489
--- /dev/null
+++ b/lib/tusker_push_web/controllers/push_controller.ex
@@ -0,0 +1,33 @@
+defmodule TuskerPushWeb.PushController do
+  use TuskerPushWeb, :controller
+
+  require Logger
+
+  def push(conn, %{"id" => id}) do
+    with {:registration, registration} when not is_nil(registration) <-
+           {:registration, TuskerPush.get_registration(id)},
+         :ok <- TuskerPush.check_registration_expired(registration),
+         {:ok, body, conn} <- read_body(conn) do
+      IO.inspect(body |> byte_size())
+      send_resp(conn, 200, "ok")
+    else
+      {:registration, nil} ->
+        send_resp(conn, 400, "unregistered")
+
+      {:expired, registration} ->
+        TuskerPush.unregister(registration)
+
+        send_resp(conn, 400, "unregistered")
+
+      {:more, _, conn} ->
+        Logger.error("Didn't finish reading")
+
+        send_resp(conn, 500, "failed to read body")
+
+      {:error, reason} ->
+        Logger.error("Reading body: #{inspect(reason)}")
+
+        send_resp(conn, 500, "failed to read body")
+    end
+  end
+end
diff --git a/lib/tusker_push_web/controllers/registrations_controller.ex b/lib/tusker_push_web/controllers/registrations_controller.ex
index 6cb3a36..f60dcb8 100644
--- a/lib/tusker_push_web/controllers/registrations_controller.ex
+++ b/lib/tusker_push_web/controllers/registrations_controller.ex
@@ -16,7 +16,11 @@ defmodule TuskerPushWeb.RegistrationsController do
              apns_environment: env,
              apns_device_token: token
            }) do
-      json(conn, %{id: id})
+      conn
+      |> json(%{
+        id: id,
+        endpoint: url(~p"/mastodon/push/#{id}")
+      })
     else
       {:env, nil} ->
         conn
diff --git a/lib/tusker_push_web/router.ex b/lib/tusker_push_web/router.ex
index 9a0b0a6..bd76991 100644
--- a/lib/tusker_push_web/router.ex
+++ b/lib/tusker_push_web/router.ex
@@ -10,4 +10,10 @@ defmodule TuskerPushWeb.Router do
 
     resources "/registrations", RegistrationsController, only: [:create, :delete]
   end
+
+  scope "/mastodon", TuskerPushWeb do
+    pipe_through :api
+
+    post "/push/:id", PushController, :push
+  end
 end