Environments

This reference describes Sandbox and Production availability and the addresses used for documentation, authentication, APIs, and webhooks. Applications, credentials, audiences, scopes, data, webhooks, and quotas are isolated by Application environment.

Two environment dimensions

Environment type	Values	Description
Deployment environment	development, test-us, production	Entry points and availability for developer documentation, the Console, authentication, and APIs
Application environment	sandbox, production	Application, identity-specific OAuth clients and API access grants, webhooks, quotas, and acceptance lifecycle

Application environment supports only sandbox and production. You can test a sandbox application in Development or test-us. Do not put development, test-us or release parameters in that field.

Deployment environments and availability

Deployment environment	Application use	Address source	Status
development	Sandbox development and integration	Current environment’s entry-point settings	Development only; no Production Applications or production data
test-us	Invited Sandbox acceptance testing	Entry-point settings supplied for the invited test	Invited testing only; cannot serve as a general public entry point
production	Separate Production Applications	Production integration settings	Business release target is not yet determined; currently disabled

Get entry-point addresses

Configuration	Purpose	Where to obtain it
GOODVISION_DEVELOPER_DOCS_ORIGIN	Documentation; same-origin /console/ is the current environment’s Console	Current environment integration settings
GOODVISION_IDENTITY_ISSUER	Exact OAuth/OIDC issuer	Current environment identity settings
GOODVISION_API_BASE	Enabled API product’s Base URL for the current application	API product configuration
GOODVISION_WEBHOOK_ORIGIN	Current application’s Webhook address scope	Webhook configuration

Use all four settings from the same deployment environment. Do not infer them from hostname suffixes or combine environments.

GOODVISION_DEVELOPER_DOCS_ORIGIN serves documentation and Console; it is not an API Base, OIDC Issuer or Webhook Origin. Use the current application’s GOODVISION_API_BASE, versioned paths, Audience and scopes for API calls. Reachability still requires the corresponding endpoint permissions.

Use the integration configuration supplied for the current environment. You do not need to configure platform gateways, certificates, or security controls yourself.

Identity Issuer

Use the issuer supplied by the current deployment configuration to query Discovery:

${GOODVISION_IDENTITY_ISSUER}/.well-known/openid-configuration

Clients must validate the returned issuer exactly. Never derive another environment by replacing a hostname suffix or falling back after a failure.

Move from Sandbox to Production

Production is not a switch on a Sandbox Application. Create a separate Production Application and OAuth client, request API Products, scopes, quotas, callbacks, origins, and webhooks again, and complete production acceptance. Never copy Sandbox tokens, secrets, Application IDs, webhook secrets, or business data into Production.

Review and operations entry points are not available to third parties and never share a session or OAuth client with the Developer Console.

Isolation checklist

• Record deployment environment and Application environment separately; do not use one sandbox value for both.
• Sandbox and Production use separate Applications, OAuth clients, API access grants, webhooks, and quotas.
• Match Token iss, aud and scopes to the current application’s API configuration.
• Logs and alerts identify the deployment environment and Application ID without recording credentials.
• Use Production addresses, credentials and data rather than test-us settings.

Use the exact current Application issuer and Discovery endpoints. The token_endpoint, authorization_endpoint and end_session_endpoint are returned addresses, not suffixes to infer.