Overview

Environment separation prevents test traffic from reaching production and keeps production keys out of local machines.

Recommended variables

UOUODUO_BASE_URL=https://uouo.cloud/v1
UOUODUO_API_KEY=sk-xxx...
UOUODUO_MODEL=gpt-4o-mini
UOUODUO_ENV=dev

If a third-party SDK only reads `OPENAI_API_KEY`, map the value at process startup instead of duplicating secrets in many places.

Dev

• Use a personal or project dev key.
• Set a low budget.
• Prefer inexpensive models.
• Allow detailed logs.
• Do not process real user data.

Staging

• Use a team staging project.
• Keep model behavior close to production.
• Use sanitized data.
• Enable the same logging fields as production.
• Run smoke tests before release.

Production

• Store secrets only in deployment secret managers.
• Use a separate key per service.
• Configure budgets and alerting.
• Rotate keys on a schedule.
• Review changes before deployment.

Switch script

#!/usr/bin/env bash
set -euo pipefail

case "${1:-dev}" in
  dev)
    export UOUODUO_ENV=dev
    export UOUODUO_MODEL=gpt-4o-mini
    ;;
  staging)
    export UOUODUO_ENV=staging
    export UOUODUO_MODEL=claude-3-5-sonnet-latest
    ;;
  prod)
    echo "Production keys must be loaded by the deployment platform." >&2
    exit 1
    ;;
esac

Key rotation

1. Create a new key.
2. Deploy the new key.
3. Confirm traffic appears under the new key in Logs.
4. Wait for old requests to finish.
5. Revoke the old key.

Never revoke the old key before the new key is deployed and verified.