Draft → test mode → live; suspension; what each stage relaxes and enforces.
Updated
| Stage | What it means |
|---|---|
draft | Provisioned but not yet in use. Status flag on the platform row. |
active + test mode | Being built. Test mode relaxes origin and HTTPS enforcement only, so you can develop against before the platform has a domain. |
http://localhostactive + live mode | In production. Public keys must present an allowed origin over HTTPS. |
suspended | The kill switch. Every key fails on its next request; data is retained. |
Test mode is narrow on purpose. It does not relax:
New platforms start in test. Going live is a deliberate flip, not a default you inherit by forgetting — and the flip is refused if a public key has no allowed origin, since that key would otherwise start failing everywhere the moment you switched.
Independently of platform mode, every key is minted as live or test (dfd-platform-secret-key-test-…). Test-environment keys skip origin/TLS checks so local tooling works, which makes them the right thing to put in a development .env — and the wrong thing to ever deploy.
Even on a live platform, a localhost Origin is allowed for public keys: that header can only come from a page served on the developer's own machine — a remote attacker cannot make a browser send it. It is the same carve-out the storefront keys use, and it keeps local debugging possible against production data you are authorized to see.