Testing With Hosted Staging
Use a hosted staging application for integration tests. Keep unit tests fast with mocks around your own SPAPS adapter, then use a small staging suite to prove the real authentication and entitlement contract.
Test Layers
| Layer | Target | Recommended proof |
|---|---|---|
| Unit | Your adapter and business rules | Mock client responses and error cases |
| Contract | Hosted staging application | Verify key type, origin, auth, and response shape |
| Browser | Your app plus hosted staging | Sign in and exercise one protected user flow |
| Server | Your backend plus hosted staging | Exercise one privileged call without exposing the secret |
Environment
SPAPS_API_URL=https://api.sweetpotato.dev
SPAPS_API_KEY=spaps_sec_your_staging_keyUse synthetic staging users and idempotent test data. Never copy production credentials or personal data into test configuration.
A mocked test proves your code. It does not prove credentials, allowed origins, deployed API behavior, or application-scoped token matching. Keep at least one focused hosted-staging contract test.
Promotion Gate
Before switching to production credentials, prove:
- publishable-key requests reject unlisted origins;
- secret-key requests originate only from your server;
- an application-bound token from another application is rejected;
- refresh and logout update the user session as expected;
- entitlement denial and success paths both behave correctly.