Environments

Live and Test in one console — separate issuers, keys, origins, allowed IPs and members, and why a Test key can never mint a Live member.

Your client has two environments, Live and Test, and one console holds both. You integrate in Test, then go live by switching the console to Live and setting up there.

Each environment has its own:

issuer, and the signing keys under it, so a Test key can never mint a Live member;
allowed origins;
allowed IPs, the addresses your servers may call the exchange from;
members. The same customer ID in Test and in Live is two members, with two histories.

Everything else is your client’s, and both environments share it: lessons, courses, your brand and rewards. A Test member reads what is published, as a Live member does.

Live and Test

	Live	Test
Your `iss`	`urn:doshi:<slug>:live`	`urn:doshi:<slug>:test`
Your assertion’s `aud`	The exchange endpoint	The same
The embed URL	`https://surface.doshi.app/embed.html?client=<slug>&env=live`	`https://surface.doshi.app/embed.html?client=<slug>&env=test`
`http://localhost` origins	Refused	Accepted
Allowed IPs	Required: an empty list refuses every exchange	Optional: an empty list accepts any address
Member reset	Refused	In the console, and the member’s own Reset my data in the iframe and the webview
The hosted link	Yes	No

The last segment of your iss is the environment, and Doshi assigns it. Copy iss and aud from your console’s Setup values rather than composing them from this table, and put them in configuration rather than in code.

Test is real. The coach, the content and email behave in Test as they do in Live. Only the rows above differ.

Live needs your servers’ addresses before its first exchange. Doshi refuses a Live exchange from any address your Live list does not hold, and refuses every one while the list is empty, with unauthorized_client. Add your servers’ IPv4 addresses in the console before you go live. In Test the list is empty until you add one, and then Test checks it exactly as Live does.

A member token names its environment, and Doshi refuses one from the other. The embed URL’s env must match the token the page hands over, or the frame treats the token as missing and ends with auth_expired. It also warns in the browser console, naming both. The SDK has no env: it takes the environment from the token.

Ours

These are the same for Live and Test.


Exchange endpoint	`https://gateway.doshi.app/oauth/token`
Our issuer (`iss` on the member token)	`https://developers.doshi.app`
Our JWKS	`https://developers.doshi.app/.well-known/jwks.json`
The hosted link	`https://surface.doshi.app/?client=<slug>`, until `https://<slug>.doshi.app` is live

The hosts the SDK talks to are on Content Security Policy.

Our issuer also serves an OpenID discovery document, at /.well-known/openid-configuration. It is there for the services that verify member tokens, not for you: the authorization_endpoint and token_endpoint it names are not served, so do not point an OAuth client at it. The exchange endpoint above is the only one your backend calls.

Supported browsers

Our page and the SDK support Safari 16 (iOS 16) and later, and Chrome 107 and later, including Android System WebView 107. A member on an older engine may find Learning unavailable. This holds for the iframe, the SDK and the webview alike.

Yours

Your two issuers are distinct, and that much we enforce: a key belongs to the issuer it was added under, so a key added in Test cannot sign for Live.

You should also use a distinct signing key per environment. We cannot enforce that — nothing stops you adding the same public key under both — but sharing one key means a Test key leak is a Live key leak. Treat it as a requirement of your own.

A workable convention:

	Live	Test
Your JWKS, if you publish one	`https://bank.example/doshi/jwks.json`	`https://bank.example/doshi/test/jwks.json`
Your key	A Live-only key pair, in your HSM or KMS	A Test-only key pair

Getting access

Your console is at https://console.doshi.app. Its header switches between Live and Test, and the environment is in its address, so a link to a console page keeps it. The Members page and the Integration tab of Settings are the environment’s own and follow the switch. The Academy and the rest of Settings are shared by both.

You get in by invite, and the first one comes from Doshi. One invite covers both environments. See Access and invites.