TrustGraph has two API environments. Start through early access; there is no sandbox.
| Environment | API origin | Use |
|---|---|---|
| Staging | https://trust-staging.rebellion.systems | Integration development through early access |
| Production | https://trust.rebellion.systems | Production integrations after onboarding |
Configure your application
Keep the selected server origin, allowed app origin, issuer identity, pinned Ed25519 attestation keys, and SDK/circuit version together in reviewed application configuration. Obtain pins through onboarding and your application's trusted release process.
An app origin is an exact scheme://host[:port] value. Register each origin you need; changing a port changes the origin. The bind return path is /trust-graph/bind/callback on that origin. Serve that path in your application, including on a direct navigation after a browser reload.
Browser CORS access and the bind-origin allowlist are separate configuration requirements. Arrange both during onboarding.
Keep state separate
Store device keys, pending binds, node references, and verified device-chain pins under the selected environment. Finish a pending bind against its recorded server origin. Do not change its origin to switch networks.
The service's public origin is also the issuer identity for content membership certificates. Pin it explicitly. An authentication page or callback host does not replace that issuer identity.
Prepare production
Confirm production package access, application origins and browser configuration with the onboarding team. Supply production attestation pins through a trusted channel, test the complete bind callback, and verify positive and negative query handling. Review device recovery, API errors and limits, and security.
Publish replacement pins in clients before an attestation signing-key rotation. A circuit update needs a reviewed verification-key update and compatible SDK release.