> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flynet.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Environments

> Staging vs production base URLs and the two-credential-set model.

## Staging

|                    |                                                                                      |
| ------------------ | ------------------------------------------------------------------------------------ |
| API base           | `https://api.staging.blackbird.xyz/flynet/v1`                                        |
| OAuth base         | `https://api.staging.blackbird.xyz/oauth`                                            |
| Consent host       | `https://passport.staging.flynet.org` (reached via redirect from `/oauth/authorize`) |
| JWT issuer (`iss`) | `https://api-staging.blackbird.xyz`                                                  |

## Production

|                    |                                                                              |
| ------------------ | ---------------------------------------------------------------------------- |
| API base           | `https://api.blackbird.xyz/flynet/v1`                                        |
| OAuth base         | `https://api.blackbird.xyz/oauth`                                            |
| Consent host       | `https://passport.flynet.org` (reached via redirect from `/oauth/authorize`) |
| JWT issuer (`iss`) | `https://api.blackbird.xyz`                                                  |

<Warning>
  **Chef's warning** - Production access is gated by partner approval.
  Do not hard-code production URLs in open-source samples or public
  demos until your integration is approved.
</Warning>

<Note>
  **Tasting note** - The JWT `iss` claim on staging uses a hyphen
  (`api-staging`), while the API hostname uses a dot (`api.staging`).
  Both DNS-resolve. The hyphen form is the auth tenant, the dot form
  is the API gateway. If you verify JWT signatures or check `iss`,
  expect the hyphen form on staging.
</Note>

<Note>
  **Tasting note** - The OAuth flow starts at the OAuth base
  (`/oauth/authorize`) but 302-redirects the browser to the consent
  host `passport.staging.flynet.org` for the member to sign in and
  approve. That's the same auth-tenant-vs-gateway split you see in the
  `iss` claim. The authorize request must carry PKCE parameters
  (`code_challenge` + `code_challenge_method=S256`); see [OAuth](/concepts/oauth).
</Note>

## Two credential sets

When your app is approved, Blackbird sends two complete credential
sets: one for staging and one for production. Each set has its own
`client_id`, `client_secret`, registered redirect URI, API key, and
if applicable, `flynet_merchant_id`.

|             | Staging                        | Production                    |
| ----------- | ------------------------------ | ----------------------------- |
| Use for     | Local dev, integration testing | Live traffic                  |
| API base    | `api.staging.blackbird.xyz`    | `api.blackbird.xyz`           |
| Credentials | Issued at approval             | Issued at production sign-off |

The API key prefix tells you the environment: `fly_test_` is a
staging/dev key, `fly_live_` is a production key. The binding is also
enforced server-side via the DeveloperApp that minted the key. Use the
key you received against the environment you were provisioned for. Don't
try to swap keys across environments; they're issued separately and
authenticate against their own surface.