Test keys, test mode, localhost — and which lever to reach for.
Updated
| Lever | Scope | Relaxes |
|---|---|---|
Test-environment key (…-key-test-…) | That one key | Origin allowlist + TLS. Nothing else. |
| Platform test mode | The whole platform |
| Origin + HTTPS enforcement (no domain exists yet). Key validity, platform status and module gates still apply. |
| Localhost carve-out | Any public key, any time | Origin match for a localhost Origin only — it can only come from the developer's own machine. |
# dashboard/portal app — .env.local
DASH_PLATFORM_KEY=dfd-platform-secret-key-test-… # test key for dev
DASH_PLATFORM_API_URL=https://api.dashfordevs.com # or a local backend
# a client site — .env.local
LPS_SITE_KEY=dfd-site-secret-key-test-…
LPS_API_URL=http://localhost:8000 # local backend, when running one
Website records carry an environment (production / staging) — a staging site is just another site with its own keys, deployed the same way, pointed at a staging subdomain. The allowlist keeps its public key useless anywhere else.