Most API platforms give you test keys and live keys. Stripe does it. Twilio does it. It feels like magic - you test against a sandbox, flip to production, and nothing leaks. We just shipped a Public REST API for PaperLink - a document sharing and analytics platform. Our test/live isolation uses the simplest possible architecture: one boolean column in the same table. No separate databases, no shadow schemas, no data duplication. Here's how it works, why it's safe, and what the actual requests look like. The two keys When you create an API key in PaperLink, you pick a mode: Live - operates on production data Test - operates on an isolated sandbox The keys look different on purpose: Live: pk_live_AbC123XyZ789... Test: pk_test_xyZ987AbC321... Enter fullscreen mode Exit fullscreen mode You see which one you're using before you paste it anywhere. What "isolation" actually means Test and live products live in the same Postgres table.…