Skip to main content
When you create a project in the Hub dashboard, you get two environments: Development and Production. They are not interchangeable. Each is tuned for a different stage of building and shipping. The SDK knows which one you are using from your API key prefix (ck_dev_… or ck_prod_…). Point your local app at development keys; point your deployed app at production keys.
For plugins where you bring your own OAuth app, both environments share the same callback URL (https://auth.corsair.dev/oauth/callback). You register it once with GitHub, Google, and so on, and Hub routes the result back to the environment that started the flow. Managed plugins skip this; Corsair hosts the OAuth app.

​
Development environment

Start here. Local work stays fast: no delivery URL to register in the dashboard, no production activation step. Some characteristics of Development:
  • Reaches localhost for you. Hub’s servers cannot call http://localhost directly. When your local app has a Corsair tunnel open, Hub POSTs the signed result to that tunnel; if no tunnel is live, it falls back to a browser redirect. Either way you do not run ngrok or expose a public URL yourself.
  • Delivery target is resolved for you. You do not register a delivery URL in the dashboard for development. CORSAIR_DELIVERY_URL overrides the local address when set.
  • Separate credentials. Development has its own API key and signing secret. They are shown on the Keys tab when the environment picker is set to Development.
  • Relaxed setup. No “activate” step. As long as your app is running locally and you are using ck_dev_… keys, connect flows work.
  • All configured plugins available. Useful for trying integrations before you ship. Production may ask you to choose which Corsair-managed integrations to enable. See Hub dashboard.
Development is for building and testing on your machine. It is not a substitute for a deployed production setup.

​
Local setup

.env.local
Copy development credentials from the dashboard Keys tab. Mount your handler at /api/corsair and run your app. Hub handles the rest.

​
Production environment

This is your live, deployed application: real users, real OAuth flows, real traffic. Some characteristics of Production:
  • Requires activation. Before connect flows work, register a public HTTPS delivery URL in the dashboard (Delivery URLs tab). This tells Hub where to send results in production.
  • Server-to-server delivery. Hub POSTs a signed envelope directly to your app. There is no browser redirect; the user’s browser is not in the loop after OAuth completes.
  • Stricter URL rules. Delivery URLs must be public HTTPS endpoints. localhost is rejected.
  • Separate credentials. Production has its own API key and signing secret (ck_prod_…). Never commit them; set them in your host’s environment variables.
  • Corsair-managed integrations. If your plan limits how many integrations Corsair manages in production, the dashboard asks you to select which ones. Development does not apply this limit.
When you deploy, switch your env vars from development keys to production keys and complete the activation step first.

​
Deploy setup

1

Activate production in the dashboard

Open your project, switch the environment picker to Production, and go to Delivery URLs. Register your handler, for example https://your-app.com/api/corsair.
2

Set production credentials on your host

3

Deploy

Production connect, credential delivery, and approval flows now POST signed envelopes to your registered URL.

​
Why delivery works differently

Hub lives on the public internet (auth.corsair.dev). Your app does not, at least not while you are developing locally. That gap drives almost every difference between the two environments. In development, your app runs on localhost, which Hub’s servers cannot call directly. When your local app has a Corsair tunnel open, Hub POSTs the signed result to that tunnel, which forwards it to your local handler. When no tunnel is live, Hub falls back to redirecting the user’s browser to your handler with a signed payload (?d=…); the browser is already on your machine, so it can reach localhost. Either way you do not run ngrok or expose a public URL yourself. Your handler verifies every payload with your signing secret before accepting it. In production, your app runs on a public HTTPS domain. Hub POSTs a signed envelope straight to your registered delivery URL. This is more secure and more reliable for live traffic: the result never passes through the browser URL bar, and your handler verifies every payload with your signing secret before accepting it. Same Hub project, same provider callback URL, but a different delivery path depending on which API key started the flow.

​
Preview and staging

Hub provides Development and Production per project. There is no separate “staging” environment type today. Here are practical patterns:
Use development API keys (ck_dev_…) on preview deployments. Set CORSAIR_DELIVERY_URL to the preview URL of your handler, for example https://my-app-git-feature-team.vercel.app/api/corsair.Hub delivers the same way as local development, so this works for PR previews without activating production.

​
Quick reference

​
What’s next

Delivery URLs

Handler mounting and signing in more detail.

Hub dashboard

Keys, connections, sign-in links, and activation.

Hub overview

Full setup from scratch.

Connect / OAuth

The createLink API reference.