Skip to main content

Environments, organisations, and CORS

A Sumvin partner integration is partitioned into three nested pieces: an organisation, one or more environments inside it, and a set of CORS origins per environment.

The three levels

Typical partitioning

Three environments per organisation is the standard pattern:
Each environment has its own auth-provider connection — a Dynamic development tenant attaches to the development environment; a Dynamic production tenant attaches to the production environment. A JWT minted for one environment cannot authenticate to another.

What this buys you

  • Isolation. Swapping auth provider credentials in development doesn’t touch production.
  • Safe experimentation. Permissive CORS on development (for localhost) is safe because it only applies to that environment.
  • Auditability. Every call is scoped to an environment; the dashboard shows which environment a request landed in.

See also

Referenced from