Environments and access

Test and live configuration remain separate so experimentation cannot silently become production authority.

Test environment

An approved application begins with an active test environment and only the capabilities enabled for that preview. Test keys, redirects, subjects, and activity must never be treated as live data.

Live environment

A live environment begins disabled. Production review evaluates ownership, exact redirect destinations, requested claims, user-facing disclosures, public policies, security contacts, and the completed test integration.

Access requirements

Verified owner and admitted organization membership.
Exact HTTPS redirect URIs under controlled domains.
Separate public keys and credentials for each environment.
A stated purpose for every capability and requested claim.
Manual Supah approval before live access is enabled.

Current state

The source-level Console onboarding contract can describe organizations, applications, and test environments, but no public sandbox credential or end-user identity endpoint is currently issued.