# Environments

Use staging for development and configure independent trust anchors for each environment.


TrustGraph has two API environments. Start through [early access](/early-access); there is no sandbox.

| Environment | API origin | Use |
| --- | --- | --- |
| Staging | `https://trust-staging.rebellion.systems` | Integration development through early access |
| Production | `https://trust.rebellion.systems` | Production integrations after onboarding |

## Configure your application

Keep the selected server origin, allowed app origin, issuer identity, pinned Ed25519 attestation keys, and SDK/circuit version together in reviewed application configuration. Obtain pins through onboarding and your application's trusted release process.

An app origin is an exact `scheme://host[:port]` value. Register each origin you need; changing a port changes the origin. The bind return path is `/trust-graph/bind/callback` on that origin. Serve that path in your application, including on a direct navigation after a browser reload.

Browser CORS access and the bind-origin allowlist are separate configuration requirements. Arrange both during onboarding.


**Never**
Never accept attestation keys or a circuit verification key supplied by the response being verified. A signature checked against a key chosen by that response does not establish trust in the configured service.

## Keep state separate

Store device keys, pending binds, node references, and verified device-chain pins under the selected environment. Finish a pending bind against its recorded server origin. Do not change its origin to switch networks.

The service's public origin is also the issuer identity for content membership certificates. Pin it explicitly. An authentication page or callback host does not replace that issuer identity.

## Prepare production

Confirm production package access, application origins and browser configuration with the onboarding team. Supply production attestation pins through a trusted channel, test the complete bind callback, and verify positive and negative query handling. Review [device recovery](/api/devices), [API errors and limits](/api), and [security](/security).

Publish replacement pins in clients before an attestation signing-key rotation. A circuit update needs a reviewed verification-key update and compatible SDK release.


**Does not establish**
An endpoint URL does not guarantee that an optional capability is enabled. Check the documented readiness capabilities for optional core features such as tags and handles, and handle explicit unavailable responses.