Environments
Development, staging and production inside one organization. Each has its own API keys, visitors, events, rules, webhooks and request filters.
A new organization starts with three. You can add more.
The rule that makes it safe
The API key decides the environment. Nothing in a request payload names one.
Two consequences worth stating plainly:
- A client cannot claim to be staging to dodge a production rule.
- Adopting environments needs no SDK change. You point a build at a different key.
What is scoped where
| Scoped to | |
|---|---|
| API keys, visitors, events | environment |
| Rules, webhooks, request filters | environment |
| Members, roles, invitations, audit log, encryption and proxy secrets | organization |
Identity is scoped too
This is the part that is easy to get wrong. The same handset hitting staging and production is deliberately two visitors.
A device you are testing with should never appear in production analytics, and a visitor id leaked from a test build should not be a real one. If you need the same device to be the same visitor across both, you want one environment, not two.
The default environment
An organization always has exactly one. New sessions land there, and keys are created there unless another is named.
It cannot be deleted or demoted to nothing — you promote another one first, in a single statement, so there is never a moment with two defaults or none.
Deleting one
Destroys its keys, rules, webhooks, filters, visitors and events, and reports what it removed.
That is done explicitly rather than by database cascade, table by table in batches, so that a large environment never holds the database in one statement.
A deleted environment's public key stops identifying entirely, rather than merely being revoked.
Reading across environments
The Management API scopes listings with ?environment=.
Unscoped means the whole organization; usage reports both ways.
curl -G https://api.antibot.dev/api/management/v1/api-keys \
-H "Authorization: Bearer $ANTIBOT_MANAGEMENT_KEY" \
-d environment=env_staging
The Server API has no such parameter, because a secret key already belongs to exactly one environment.