---
title: "Give each environment its own provider key · Agent Wranglers"
url: https://agentwranglers.se/playbook/api-design/using-other-companies-apis/key-per-environment
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Give each environment its own provider key

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Using other companies' APIs](https://agentwranglers.se/playbook/api-design/using-other-companies-apis.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- ID: API-80
- Level: Required
- Chapter: [Using other companies' APIs](https://agentwranglers.se/playbook/api-design/using-other-companies-apis)
- Rule: Use a separate key for each outside API in each environment, with only the permissions that environment needs. Only production holds a production key.
- Risk: Data leaked or lost
- How: A shared key lets a test run send mail to customers or delete live records. A leak in staging then also opens production. Point every environment except production at the provider's sandbox or test account. Keep the keys per environment in a [secrets store](https://agentwranglers.se/playbook/engineering/running-in-production/secrets-store), never in code, as [keep secrets out of code](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/secrets-out-of-code) says. When a provider marks its keys, such as a `live` or `test` prefix, make the adapter refuse to start with the wrong kind. Payment keys follow [keep test and live modes apart](https://agentwranglers.se/playbook/payments/checkout-and-card-data/test-and-live-keys).
- Check: For each provider, the key IDs in staging and production differ. Revoke the staging key, and production calls still succeed. Start staging with a key marked as live, and it exits with an error.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
const LIVE_KEY_PREFIX = 'live_';

export function carrierKey(environment = process.env.APP_ENV) {
  const key = process.env.CARRIER_KEY;
  if (!key) throw new Error('CARRIER_KEY is missing');
  if (environment !== 'production' && key.startsWith(LIVE_KEY_PREFIX)) throw new Error('live carrier key outside production');
  return key;
}
```

### Python example

```python
import os

LIVE_KEY_PREFIX = "live_"

def carrier_key(environment: str = os.environ.get("APP_ENV", "development")) -> str:
    key = os.environ["CARRIER_KEY"]
    if environment != "production" and key.startswith(LIVE_KEY_PREFIX):
        raise RuntimeError("live carrier key outside production")
    return key
```

## Related rules

- [Keep secrets in a secrets store](https://agentwranglers.se/playbook/engineering/running-in-production/secrets-store) in Engineering
- [Keep secrets out of code](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/secrets-out-of-code) in Security testing
- [Keep test and live modes apart](https://agentwranglers.se/playbook/payments/checkout-and-card-data/test-and-live-keys) in Payments

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/api-design/using-other-companies-apis/key-per-environment">Agent Wranglers API design playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Pin their API version and watch for its end](https://agentwranglers.se/playbook/api-design/using-other-companies-apis/pin-and-watch-versions)
- [Using other companies' APIs](https://agentwranglers.se/playbook/api-design/using-other-companies-apis)