> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sumvin.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Environments, organisations, and CORS

> How a partner partitions an integration into isolated namespaces with their own credentials and origins.

# Environments, organisations, and CORS

A Sumvin partner integration is partitioned into three nested pieces: an **organisation**, one or more **environments** inside it, and a set of **CORS origins** per environment.

## The three levels

| Level            | What it represents                                                                                                                                                                                                                                           |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Organisation** | A single partner tenant. One organisation per company (or per business unit).                                                                                                                                                                                |
| **Environment**  | An isolated namespace inside an organisation with its own auth provider credentials and SDK credentials.                                                                                                                                                     |
| **CORS origin**  | The browser-origin allow-list tying an environment to the domains that may present credentials to <Tooltip headline="SIS" tip="Sumvin Identity Service — the B2B API that exchanges signed PINTs for JWTs." cta="Glossary →" href="/glossary">SIS</Tooltip>. |

## Typical partitioning

Three environments per organisation is the standard pattern:

```text theme={null}
organisation: acme-inc
  ├── development   — dev auth-provider credentials, localhost CORS
  ├── staging       — staging credentials, staging domain
  └── production    — production credentials, production domain only
```

Each environment has its own auth-provider connection — a Dynamic development tenant attaches to the `development` environment; a Dynamic production tenant attaches to the `production` environment. A JWT minted for one environment cannot authenticate to another.

## What this buys you

* **Isolation.** Swapping auth provider credentials in `development` doesn't touch `production`.
* **Safe experimentation.** Permissive CORS on `development` (for localhost) is safe because it only applies to that environment.
* **Auditability.** Every call is scoped to an environment; the dashboard shows which environment a request landed in.

## See also

* [Organisations](/dashboard/organisations) — managing the top level
* [Environments](/dashboard/environments) — per-environment config
* [CORS origins](/dashboard/cors-origins) — managing allowed origins
* [Auth providers](/dashboard/auth-providers) — attaching Dynamic, Privy, or SIWE per environment

## Referenced from

* [SIS Dashboard introduction](/dashboard/introduction)
* [Auth model](/concepts/auth-model)
* [App developer persona](/overview/personas/app-developer)