---
title: "Keep test and live modes apart · Agent Wranglers"
url: https://agentwranglers.se/playbook/payments/card-security-and-sca/test-and-live-keys
id: PAY-5
level: Required
applies: payments
risk: money
updated: 2026-10-27
build: a2a6bdfed830
tokens: 983
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Keep test and live modes apart

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Card security and SCA](https://agentwranglers.se/playbook/payments/card-security-and-sca.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: PAY-5
- Level: Required
- Chapter: [Card security and SCA](https://agentwranglers.se/playbook/payments/card-security-and-sca.md)
- Rule: Use the provider's test mode in every environment except production, and make the app refuse to start with a live key anywhere else.
- Check: Start staging with a live key. It exits with an error. Search the repository for `sk_live_` and `rk_live_`. Nothing is found.
- Risk: Money lost or taken twice
- Applies when: The project takes payments.
- How: Providers give separate test and live API keys and separate webhook secrets. Keep them per environment in a [secrets store](https://agentwranglers.se/playbook/engineering/running-in-production/secrets-store.md). Check the key prefix at startup, such as `sk_live_` and `sk_test_` at Stripe. Use restricted keys with only the permissions the app needs. Never copy live customer or payment data into test. Test systems also must not email, text or push to customers, as [Never contact customers from test systems](https://agentwranglers.se/playbook/notifications/channels-and-preferences/test-notification-sinks.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
const isLiveKey = key => /^(sk|rk)_live_/.test(key)

if (isLiveKey(process.env.PAYMENT_API_KEY) !== (process.env.APP_ENV === 'production')) {
  throw new Error('Payment key mode does not match APP_ENV')
}
```

### Python example

```python
import os, re

def is_live_key(key: str) -> bool:
    return re.match(r"^(sk|rk)_live_", key) is not None

if is_live_key(os.environ["PAYMENT_API_KEY"]) != (os.environ["APP_ENV"] == "production"):
    raise SystemExit("Payment key mode does not match APP_ENV")
```

## Sources

- [Stripe API keys, sandbox versus live mode](https://docs.stripe.com/keys)

## Related rules

- TST-58 [Make the test setup refuse production](https://agentwranglers.se/playbook/testing/test-data-and-environments/tests-refuse-production.md) in Testing
- API-80 [Give each environment its own provider key](https://agentwranglers.se/playbook/api-design/using-other-companies-apis/key-per-environment.md) in API design
- ENG-26 [Keep secrets in a secrets store](https://agentwranglers.se/playbook/engineering/running-in-production/secrets-store.md) in Engineering
- NTF-8 [Never contact customers from test systems](https://agentwranglers.se/playbook/notifications/channels-and-preferences/test-notification-sinks.md) in Notifications
- INF-10 [Give each environment its own account](https://agentwranglers.se/playbook/infrastructure/environments/account-per-environment.md) in Infrastructure and environments

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/payments/card-security-and-sca/test-and-live-keys">Agent Wranglers payments and billing playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Save cards with consent and charge renewals off-session](https://agentwranglers.se/playbook/payments/card-security-and-sca/off-session-payments.md)
- Next: [Test every payment outcome with test cards](https://agentwranglers.se/playbook/payments/card-security-and-sca/payment-test-scenarios.md)
- [Card security and SCA](https://agentwranglers.se/playbook/payments/card-security-and-sca.md)