> ## Documentation Index
> Fetch the complete documentation index at: https://docs.quotamint.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Test and live environments

> Keep development, staging, and production traffic separated

QuotaMint uses API-key prefixes to prevent accidental environment mixing.

| Dashboard label | Key prefix | Use                           |
| --------------- | ---------- | ----------------------------- |
| Test            | `qm_test_` | Local development and staging |
| Live            | `qm_live_` | Production traffic            |

A live key cannot authenticate against a test environment, and a test key cannot authenticate against live data. A prefix/environment mismatch returns `401`.

## Recommended setup

For most teams:

* One project for development and staging, using test keys
* One project for production, using live keys
* Separate customer records in each project

Use separate projects for test and live when balances, plans, or customer IDs must be isolated. Environments on keys select the runtime environment, but the data model itself is project-scoped.

## Create keys

Create keys in the dashboard under **API keys**. A key secret is shown once:

```text theme={null}
qm_test_<32 bytes of random base64url data>
qm_live_<32 bytes of random base64url data>
```

Store the secret in a server-side secret manager. QuotaMint shows it once and never again — not in logs, not in the dashboard.

## Rotation

Create a replacement key, deploy it, confirm traffic uses it, then revoke the old key. Revocation is immediate for future requests. Do not overwrite a secret in source control or a client bundle.

## Project disable switch

A disabled project returns `403 project_disabled` from the runtime. The setting is reversible and is useful as an operational stop switch. Build a clear customer-facing fallback for this case.