Sandbox and live: planes and keys

Two deployments, not two modes

The developer sandbox and live are separate deployments with separate databases. A key, a brand's configuration and a webhook receiver exist only on the deployment where they were created. There is no test mode inside live, and nothing you do in the sandbox reaches live data.

A ak_sandbox_ key presented to live, or a ak_live_ key presented to the sandbox, is refused before any lookup. Each plane's API host at /v1 is its canonical base URL once it serves; the deployment's own origin at /api/v1 stays served as an alias, with the same routes: /v1/<path> on the API host is /api/v1/<path> on the alias. Until an API host serves, call its alias, or the origin of the deployment whose console issued your key, at /api/v1; the API reference prints it.

Every answer says which plane served it: Ambition-Environment is sandbox or live, and Ambition-Livemode is false or true. The deployment sets both; nothing in your request changes them. On the sandbox all data is synthetic.

Configure your brand on each deployment: programs, state policy, subscription terms, care host, external sites and receivers. A tool that promotes sandbox configuration to live is planned; until it ships, the two are set up separately, and the production access review checks the live configuration.

A key carries only what its creator can see

Every key is bound to one brand and one plane. Each scope needs a console capability, and the database refuses a scope the person creating the key does not hold.

Enrollment status is treated as health information, so the enrollment scopes need minimum-necessary patient access, which a developer role does not have.

Rotation and revocation

• Rotating a key mints a new secret and keeps the old one working for an overlap of 0 to 168 hours, so a deployment can switch without downtime.
• Revoking a key stops it at once. A lost secret is never shown again: revoke the key and create another.
• Only a SHA-256 digest of a secret is stored. Keep secrets in your server's secret manager, never in a browser or a repository.

Getting a live key

Live keys are not available yet. When production access opens, the brand's tenant owner requests one named key on the live deployment with two-step verification, attaching a signed sandbox certification bundle or asking for the manual checklist. A platform administrator other than the requester approves it only with Gate B go, the brand-to-entity business associate agreement in force and the brand's external sites registered and attested, and the owner then issues the key within seven days.