# Environments and keys

> Build against the sandbox with a ck_test_ key, then switch to a ck_live_ key for real patients.

## Pick an environment

| | Demo | Sandbox | Production |
| --- | --- | --- | --- |
| Key | None | `ck_test_…` | `ck_live_…` |
| Data | Fictional patients | Synthetic patients you create | Real patients who consent |
| Base URL | `https://api.finchnode.com/demo/v1` | `https://api.finchnode.com/api/v1` | `https://api.finchnode.com/api/v1` |
| Health systems | None | Synthetic health systems | Real ones |
| Get it | Nothing to set up | Create an application | Turn on production for the application |

A key belongs to one application and one environment. A sandbox key reads only sandbox connections, and a production key reads only production connections. A production key asking for a sandbox subject gets `410 consent_inactive`. `GET /app` and every Connect session report their `environment`.

## Keep keys on your server

Send the key as a bearer token from your backend:

```http
Authorization: Bearer $FINCHNODE_API_KEY
```

- Never put a key in a browser, mobile app, URL, or log.
- Store it in a secret manager, not in source control.
- The console shows a new key once and keeps only a hash, so copy it when you create it.

## Rotate a key

Create a new key in the console, deploy it, then revoke the old one. Both work until you revoke the old key, so you can switch without downtime.

## Go to production

An application can turn on production when its settings are complete:

- a specific purpose, shown to patients on the consent screen
- at least one data category
- how long your app keeps the records it imports
- a privacy policy URL
- a webhook URL

Creating the first production (`ck_live_`) key turns production on. If a setting is missing, the console lists what to add. While a [conformance run](/docs/testing/conformance) is open, and for about a minute after one ends, the console won't turn production on, and says why. Your plan sets how many applications can be live at once; see [pricing](/#pricing).

Production doesn't require a conformance run, but one checks your integration against the sandbox before your first production key.

## Response headers

| Header | Tells you |
| --- | --- |
| `X-Request-Id` | The request's ID. Include it when you contact support. |
| `FinchNode-Version` | The response contract version. |
| `RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset` | Your remaining budget. See [Rate limits](/docs/resources/rate-limits). |
| `Cache-Control: private, no-store` | Sandbox and production responses can contain health information, so browsers and proxies must not store them. |

## Suspension

FinchNode can suspend an application for policy violations. Live keys then stop working, new production sessions are refused, and sandbox simulation returns `403 app_suspended`. Contact support to reinstate it.