# Environments, credentials, and test data

Genuin runs two environments with separate data and separate credentials. Build and test against QA, then switch to Production with the Production credentials.

## Base URLs

| Environment | Server API base URL | SDK switch |
| --- | --- | --- |
| Production | https://api.begenuin.com | Default on every SDK |
| QA | https://api.qa.begenuin.com | iOS GenuinConfiguration.shared.environment = .qa; Android GenuinSDK.initSDK(this, "YOUR_API_KEY", genuinEnv = GenuinEnv.QA); React Native and Flutter take the environment on initialization (see [Integrate the Genuin SDK with React Native apps](https://begenuin.com/developers/developer-resources/sdk/how-do-you-integrate-the-genuin-react-native-sdk-into-your-application) and [Initialize the Genuin SDK and load a feed in Flutter](https://begenuin.com/developers/developer-resources/sdk/flutter-sdk-developer-reference-how-do-i-initialize-the-genuin-sdk-and-load-a-feed)) |

## Credentials

| Credential | Format | Lifetime | Keep it |
| --- | --- | --- | --- |
| API key | Brand key shown in BCC under Build › Publish Communities › SDK Integration | Until rotated by Genuin | In client code; it identifies your brand |
| api_key | 48-character hexadecimal | Until rotated by the Genuin team | On your server |
| api_secret | 32-character hexadecimal | Until rotated by the Genuin team | On your server only: environment variable or secrets manager |
| gn-access-token | Returned in a response header by [Generate an access token](https://begenuin.com/developers/developer-resources/api/generate-access-token-using-authentication-api) | 14 days in Production, 3 hours in QA | On your server; send as Authorization: Bearer |
| gn-refresh-token | Returned with the access token | 100 days in Production, 24 hours in QA | On your server; exchange at POST /api/v4/auth/session/refresh |
| SSO token | Issued by your backend for a signed-in member | Your policy | Passed to the SDK at sign-in (see [How Auto Login works](https://begenuin.com/developers/developer-resources/guides/genuin-auto-login)) |

Each environment has its own credential pair. A QA pair returns `404` with code `5235` against Production, and the reverse.

## Test data

There is no test mode inside Production and no shared test credential. Use QA for every test, including deleting test accounts with [Delete a member account](https://begenuin.com/developers/developer-resources/api/delete-a-member-account). Seed QA with a test community (see [Create a community](https://begenuin.com/developers/developer-resources/api/create-a-community-programmatically-using-community-api)), a group (see [Create a group in a community](https://begenuin.com/developers/developer-resources/api/create-a-group-programmatically-within-community-using-create-group-api)), and members added by phone number (see [Add members to a community](https://begenuin.com/developers/developer-resources/api/add-members-to-a-community-programmatically-api)): numbers without an account get a pending account, so you can test invitations without real sign-ups.

## Limits

The token, community, group, moderator, group update, post, and delete endpoints have no per-key rate limit. Adding members to a community is rate-limited (see [Add members to a community](https://begenuin.com/developers/developer-resources/api/add-members-to-a-community-programmatically-api)). Every error carries an HTTP status, a string `code`, and a `message`; match on `code` and retry only what is safe to retry (see [Handle API errors](https://begenuin.com/developers/developer-resources/api/handle-api-errors)).