Skip to main content
Heyrafiki keys are bound to one environment. Sandbox and production do not share keys or data. A key for one environment is rejected in the other.

​
Safe development

  • Keep keys in server-side secret storage.
  • Use one project per integration and environment.
  • Request only the scopes the integration needs.
  • Revoke a key when it is exposed or no longer used.
  • Never copy live health data into the sandbox.
Project approval gives each production integration the permissions and operating checks it needs. A documented production resource may therefore still require project-specific approval.
Last modified on August 14, 2026