Test and Live
Test and Live are two sets of objects: separate provider credentials, separate webhook secrets, separate encryption contexts, separate audit trails, separate policies, separate API keys. Every list and every API call names its environment.
Today every workspace is in Test. Live is fully built and gated by a per-workspace entitlement that no workspace holds.
What the switch does
The switch in the nav shows TEST as the current environment and a live link with a padlock. The link opens Settings → Environment, which renders what Live requires. It never flips anything. A toggle that cannot toggle would be a lie told in a component, so it is not one.
Open this screenshot at full size ↗
Click a numbered point on the screenshot, or in the list, to read what it is for.
Entitlement states
Click a state to read what it means and what moves it on.
What refuses a live credential in Test
Pasting a key that looks live into a test connection is refused before anything is stored, by the key's shape, not by policy:
| You pasted | Refusal | What it says |
|---|---|---|
rk_live_… or sk_live_… | LIVE_KEY_IN_TEST_ENVIRONMENT | This looks like a LIVE credential. Test connections only accept test/sandbox credentials. |
sk_test_… | SECRET_KEY_NOT_ALLOWED_USE_RESTRICTED | Stripe secret keys are not accepted. Create a restricted key instead. |
| Anything else for Stripe | KEY_PREFIX_UNRECOGNIZED | Unrecognized credential shape for this provider. |
HitPay and Airwallex keys have no prefix, so their environment binding is the host: a test connection can only reach the sandbox host, by construction.
What you can and cannot do in Test
- Everything in this manual works in Test on your own sandbox credentials, with real sandbox traffic.
- Payout release on a platform demo connection is refused (the pooled credential cannot be resolved by the dispatcher). Release on your own Airwallex sandbox connection works.
- A demo workspace never counts toward activation, whatever it does.