Environments

Environments can also be managed in the KeyStone Dashboard under Settings > Environments - no code required.

create / list / get / update / deactivate

env = await client.environments.create({
    "name": "Staging",
    "slug": "staging",
    "type": "staging",
    "auth0_client_id": "your-staging-client-id",
    "default_timeout_seconds": 3600,
})

result = await client.environments.list()
env = await client.environments.get("env-uuid")

await client.environments.update("env-uuid", {
    "default_timeout_seconds": 7200,
})

# Deactivate (preserves data, blocks M2M auth)
await client.environments.deactivate("env-uuid")

update accepts name and default_timeout_seconds only, and rejects any other key with 422. is_active and rate_limit_rpm are not settable here: deactivate with deactivate(), and ask your Keystone operator for a rate limit change or a reactivation.

Deactivation blocks credential access once it commits and closes the environment to new settlements: resting instructions no longer match, and no repo closing settlement is derived while it is inactive. Settlements already in flight keep advancing to completion, and their webhooks keep delivering.

auth0_client_id must be an M2M application your Keystone operator has already created and authorized against the Keystone API. Keystone verifies this before saving the environment: a client id that is not authorized for the Keystone API (including a client id that does not exist, or one belonging to a different API) is rejected with 422 UNRECOGNIZED_CLIENT, and an empty value is rejected as a validation error. The same check runs on secret rotation.

Environment fields

Field	Type	Description
`id`	`UUID`	Environment UUID
`platform_id`	`UUID`	Parent platform UUID
`name`	`str`	Display name
`slug`	`str`	URL-friendly identifier
`type`	`str`	`development`, `staging`, or `production` (required on create)
`auth0_client_id`	`str`	M2M credential
`api_version`	`str \| None`	Pinned API version
`default_timeout_seconds`	`int`	Default settlement timeout
`is_active`	`bool`	Whether M2M auth is accepted (read-only)
`rate_limit_rpm`	`int \| None`	Operator-granted limit, `None` means the default (read-only)

Webhook delivery is configured per endpoint under webhooks, not on the environment.

Overview

Backend SDKs

Frontend Library

Tools

create / list / get / update / deactivate

Environment fields

​create / list / get / update / deactivate

​Environment fields

create / list / get / update / deactivate

Environment fields