Give each environment its own provider key

How to do it

A shared key lets a test run send mail to customers or delete live records. A leak in staging then also opens production. Point every environment except production at the provider's sandbox or test account. Keep the keys per environment in a secrets store, never in code, as keep secrets out of code says. When a provider marks its keys, such as a live or test prefix, make the adapter refuse to start with the wrong kind. Payment keys follow keep test and live modes apart.

Examples

JavaScript example

const LIVE_KEY_PREFIX = 'live_';

export function carrierKey(environment = process.env.APP_ENV) {
  const key = process.env.CARRIER_KEY;
  if (!key) throw new Error('CARRIER_KEY is missing');
  if (environment !== 'production' && key.startsWith(LIVE_KEY_PREFIX)) throw new Error('live carrier key outside production');
  return key;
}

Python example

import os

LIVE_KEY_PREFIX = "live_"

def carrier_key(environment: str = os.environ.get("APP_ENV", "development")) -> str:
    key = os.environ["CARRIER_KEY"]
    if environment != "production" and key.startswith(LIVE_KEY_PREFIX):
        raise RuntimeError("live carrier key outside production")
    return key

How to check

For each provider, the key IDs in staging and production differ. Revoke the staging key, and production calls still succeed. Start staging with a key marked as live, and it exits with an error.

Related rules

• Keep secrets in a secrets store in Engineering
• Keep secrets out of code in Security testing
• Keep test and live modes apart in Payments