Test and live, now for consent too

Every HonkIO account has two kinds of API keys. Live keys (mk_live_...) send real messages and spend your balance. Test keys (mk_test_...) simulate sends, so you can build and run your tests without texting anyone or paying for it. The dashboard works the same way: one Live/Test switch at the top, and every page that has a mode follows it. New accounts start in Test, so the first clicks never cost money.

What changed: consent records have a mode

Until now, consent and opt-out records were shared by both modes. A consent recorded with a test key also counted for live sends, and a test suite that cleaned up by revoking consents could block live ones. Each record now belongs to the mode that created it:

• Test key or Test switch: you see and change test records only, and test sends are checked against them
• Live key or Live switch: you see and change live records only, and live sends are checked against them
• Bulk consent uploads: each upload belongs to the mode it was made in
• Replies from real phones: STOP and START are always live, and so is an unsubscribe from a live email

Your live sends need nothing from you. Every record you already had is now a live record, so live messages are checked exactly as they were yesterday. Test sends are the one thing to look at: a commercial test send now needs a consent recorded with your test key, so if your tests send commercial messages, record consent with the test key first.

Where the switch applies

• Messages: the log shows the mode you are in, and a test send is simulated and free
• Verify: in Test the code is always zeros and no text goes out
• Email: your outbox and inbox follow the switch, and test sends are simulated
• Compliance: consents, opt-outs and uploads, as described above
• Auth apps: test apps and live apps are separate, each with its own users and settings
• API keys and the Sandbox: you see and use the keys for the mode you are in

What stays shared

• Your balance and billing: there is one balance, and a test send never touches it
• Phone numbers: buying one is a real purchase in either mode, and the dashboard says so in Test
• Contacts, groups and lists: shared by both modes for now
• Email suppressions from bounces and complaints: shared, so a live bounce also stops test sends to that address

For developers

Consent, opt-out and upload responses now carry a livemode field, the same field webhook events already use. Every call works on the records of the key it is made with, so a check made with a live key ignores test records:

# Recorded with a test key, so it counts for test sends only
curl -X POST https://api.honkio.ca/v1/compliance/consents \
  -H "Authorization: Bearer mk_test_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"phone_number": "+14165550142", "consent_type": "express", "source_description": "Signup form, test run"}'

# A live key does not see it
curl "https://api.honkio.ca/v1/compliance/consents/check?phone_number=%2B14165550142" \
  -H "Authorization: Bearer mk_live_YOUR_KEY"

{
  "phone_number": "+14165550142",
  "allowed": false,
  "reason": "NO_CONSENT",
  "livemode": true
}

The rules are on the SMS consent page and the email compliance page, under Test and live records.