Environments

Stripe-style test and production namespaces inside one Retab organization

Retab environments are logical namespaces inside your organization that isolate data, runs, webhooks, secrets, and analytics. Every organization has two built-in environments:

Slug	Intended use
test	Local development, customer staging, CI, integration tests
production	Customer production systems

Workflows, files, runs, jobs, webhooks, signing secrets, integration credentials, and usage records live inside exactly one environment. A test API key cannot read or mutate production resources, and a live API key cannot read or mutate test resources.

The API key selects the environment

The API key — not a header, not a base URL, not a flag — decides which environment a request runs in.

Prefix	Environment	Notes
rt_test_	test	Issued from the dashboard under Test keys.
rt_live_	production	Issued from the dashboard under Live keys.
sk_retab_	production	Legacy keys, still valid; resolve to production.

The key prefix is a visible hint. The server’s stored environment id on the key document is the authorization source of truth — a request authenticated with an rt_test_... key cannot reach production resources even if it guesses a production id.

# Local development and CI
export RETAB_API_KEY=rt_test_...

# Production deploys
export RETAB_API_KEY=rt_live_...

Python

from retab import Retab

client = Retab()                       # reads RETAB_API_KEY
print("Run `retab auth status` to inspect the resolved environment.")

RETAB_BASE_URL is not the environment selector

RETAB_BASE_URL selects the Retab deployment (production API, a local dev server, a private region). It does not select your customer environment. Do not point RETAB_BASE_URL at a different host to switch between test and production — set RETAB_API_KEY instead.

# Wrong: this only changes the Retab deployment URL.
export RETAB_BASE_URL=https://api.retab.com

# Right: this switches your environment.
export RETAB_API_KEY=rt_live_...

What is isolated per environment

Resource	Isolated per environment
API keys	Yes
Workflows, blocks, edges, snapshots	Yes
Workflow runs, steps, artifacts	Yes
Workflow tests and experiments	Yes
Files and file-derived artifacts	Yes
Jobs	Yes
Webhook endpoints and signing secrets	Yes
Webhook delivery attempts and retries	Yes
Workflow secrets / integration creds	Yes
Usage records and analytics	Yes
Organization membership and user profile	No (organization-global)
Billing subscription	No (organization-global)

Cross-environment access returns 404 Not Found — resource existence is never leaked across environments.

Where to go next

API keys

Create test and live keys in the dashboard and use them from the SDKs.

CLI

Manage local environment profiles, switch defaults, and run safe production commands.

Webhooks and secrets

Environment-scoped webhook signing secrets and integration credentials.

Promotion

Promote a workflow from test to production as a draft for review.