Is it possible to call secure.sendNotification without an access_token?

Question

In contact with

Hello, is it possible to call this method from your own server without first obtaining an access_token?
The official documentation for secure.sendNotification states that yes, since last April, this is possible - with the help of a service access key.
I found this key in my iframe application settings , but how to embed it in the method call URL (I'm using Java and Jetty HttpClient) is not clear.
What parameter should I add to my URL?

String VK_API_URL = "https://api.vk.com/method/secure.sendNotification?user_id=%s&message=%s&v=5.71";

In addition, it is not clear in the documentation whether the service access key is bound to the IP address of the server of my game or not:

For requests to secure methods, the service key is bound to the IP address from which it was generated.

You can get a service access key in the settings of your application. The key is not bound to an IP address when used with public methods, its validity is not limited

If it is still bound, then how to get it specifically for my server?
Update:
I tried to add a parameter in the form access_token=service access token , but alas - on the GET call of the following URL:

https://api.vk.com/method/secure.sendNotification?access_token=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX&user_id=62184875&message=%D0%A1%D0%BE%D0%BE%D0%B1%D1%89%D0%B5%D0%BD%D0%B8%D0%B5+%D0%BE%D1%82+%D0%B8%D0%B3%D1%80%D0%BE%D0%BA%D0%B0&v=5.71

The response comes (even though the recipient installed my unverified game in the catalog on their own):

{"error":{"error_code":7,"error_msg":"Permission to perform this action is denied","request_params":[{"key":"oauth","value":"1"},{"key":"method","value":"secure.sendNotification"},{"key":"user_id","value":"62184875"},{"key":"message","value":"Сообщение от игрока"},{"key":"v","value":"5.71"}]}}

Adding more &client_secret=... didn't change anything

Answer 1

Available. The service key must be passed in the "access_token" parameter.
As written in the committed change , you can safely use the service key that is specified in the application settings and it will not be tied to an IP.
UPD. There is a lot of conflicting information in the documentation, somewhere you still need to request a service key for the server separately, but somewhere they write that the settings will work.
In response, I lean towards information from a change that has already been made.
Also pay attention to this.
secure . On the section page it is indicated to request a service key in the old way , but nothing prevents you from trying both the current version and the old one.