Partner Environment Model

Environments

• Development: sandbox issuer and test org clients
• Staging: production-like integration verification
• Production: live org clients and end users

Required Per-Environment Separation

• Distinct issuer URL (or issuer namespace)
• Distinct app client IDs and secrets
• Strict redirect URI allowlist per environment
• Distinct telemetry tags and dashboards

Redirect URI Rules

• Exact match only
• https required in staging/prod
• localhost is allowed only for development clients

Promotion Criteria

1. Discovery and JWKS checks pass
2. PKCE and nonce validation tests pass
3. Consent copy approved
4. Audit logging verified
5. Rollback owner assigned