Environments, credentials, and test data
Genuin runs two environments with separate data and separate credentials. Build and test against QA, then switch to Production with the Production credentials.
Base URLs
| Environment | Server API base URL | SDK switch |
|---|---|---|
| Production | https://api.begenuin.com | Default on every SDK |
| QA | https://api.qa.begenuin.com | iOS GenuinConfiguration.shared.environment = .qa; Android GenuinSDK.initSDK(this, "YOUR_API_KEY", genuinEnv = GenuinEnv.QA); React Native and Flutter take the environment on initialization (see Integrate the Genuin SDK with React Native apps and Initialize the Genuin SDK and load a feed in Flutter) |
Credentials
| Credential | Format | Lifetime | Keep it |
|---|---|---|---|
| API key | Brand key shown in BCC under Build › Publish Communities › SDK Integration | Until rotated by Genuin | In client code; it identifies your brand |
| api_key | 48-character hexadecimal | Until rotated by the Genuin team | On your server |
| api_secret | 32-character hexadecimal | Until rotated by the Genuin team | On your server only: environment variable or secrets manager |
| gn-access-token | Returned in a response header by Generate an access token | 14 days in Production, 3 hours in QA | On your server; send as Authorization: Bearer |
| gn-refresh-token | Returned with the access token | 100 days in Production, 24 hours in QA | On your server; exchange at POST /api/v4/auth/session/refresh |
| SSO token | Issued by your backend for a signed-in member | Your policy | Passed to the SDK at sign-in (see How Auto Login works) |
Each environment has its own credential pair. A QA pair returns 404 with code 5235 against Production, and the reverse.
Test data
There is no test mode inside Production and no shared test credential. Use QA for every test, including deleting test accounts with Delete a member account. Seed QA with a test community (see Create a community), a group (see Create a group in a community), and members added by phone number (see Add members to a community): numbers without an account get a pending account, so you can test invitations without real sign-ups.
Limits
The token, community, group, moderator, group update, post, and delete endpoints have no per-key rate limit. Adding members to a community is rate-limited (see Add members to a community). Every error carries an HTTP status, a string code, and a message; match on code and retry only what is safe to retry (see Handle API errors).
