Staging
Production
Tasting note - The JWT
iss claim on staging uses a hyphen
(api-staging), while the API hostname uses a dot (api.staging).
Both DNS-resolve. The hyphen form is the auth tenant, the dot form
is the API gateway. If you verify JWT signatures or check iss,
expect the hyphen form on staging.Tasting note - The OAuth flow starts at the OAuth base
(
/oauth/authorize) but 302-redirects the browser to the consent
host passport.staging.flynet.org for the member to sign in and
approve. That’s the same auth-tenant-vs-gateway split you see in the
iss claim. The authorize request must carry PKCE parameters
(code_challenge + code_challenge_method=S256); see OAuth.Two credential sets
When your app is approved, Blackbird sends two complete credential sets: one for staging and one for production. Each set has its ownclient_id, client_secret, registered redirect URI, API key, and
if applicable, flynet_merchant_id.
The API key prefix tells you the environment:
fly_test_ is a
staging/dev key, fly_live_ is a production key. The binding is also
enforced server-side via the DeveloperApp that minted the key. Use the
key you received against the environment you were provisioned for. Don’t
try to swap keys across environments; they’re issued separately and
authenticate against their own surface.