An app cannot keep its own connection to your server open: Android and iOS stop background apps to save the battery. Instead each platform keeps one connection per phone, owned by the system, to its push service: Firebase Cloud Messaging 1 (FCM, through Google Play 1 services) on Android and the Apple Push Notification service (APNs) on iOS. Your app asks the platform for a device token, an address for "this app on this phone", and sends it to your server; the server later asks the push service to deliver a message to that token:
The system shows a message with a title and body even when the app is not running; a data-only message wakes the app briefly instead. Delivery is best effort: the phone may be offline, the channel muted, the app uninstalled. And never put secrets in a notification: it appears on the lock screen.