Environments, organisations, and CORS
A Sumvin partner integration is partitioned into three nested pieces: an organisation, one or more environments inside it, and a set of CORS origins per environment.The three levels
Typical partitioning
Three environments per organisation is the standard pattern:development environment; a Dynamic production tenant attaches to the production environment. A JWT minted for one environment cannot authenticate to another.
What this buys you
- Isolation. Swapping auth provider credentials in
developmentdoesn’t touchproduction. - Safe experimentation. Permissive CORS on
development(for localhost) is safe because it only applies to that environment. - Auditability. Every call is scoped to an environment; the dashboard shows which environment a request landed in.
See also
- Organisations — managing the top level
- Environments — per-environment config
- CORS origins — managing allowed origins
- Auth providers — attaching Dynamic, Privy, or SIWE per environment