The system has been refactored to support per-request environment configuration instead of a global IS_SANDBOX flag. This allows the API to handle both production and sandbox environments simultaneously.

• Removed IS_SANDBOX from /backend/plans/config.ts
• Environment is now determined per-request

Clients can specify the environment using:

• Header: X-Environment: SANDBOX or X-Environment: PRODUCTION
• Query Parameter: ?environment=sandbox or ?environment=production
• Default: PRODUCTION (when not specified)

All database query functions now accept an optional environment parameter:

• getPlanDetails(customerId, environment)
• getLatestSubscriptionPrice(customerId, environment)
• getSubscriptionHistory(customerId, environment)
• getNonExpiringBalance(customerId, environment)
• listGrants(customerId, environment)
• ensureFreeGrant(customerId, amount, environment)
• getUserUsageStats(customerId, environment)

All endpoints now respect the environment parameter:

• /api/usage
• /api/credits/balance
• /admin/credits/:customerId
• All endpoints using the authenticateUser middleware

The webhook continues to:

• Process ALL incoming events (both sandbox and production)
• Store events with their actual environment from RevenueCat
• No filtering at webhook level

1. No Breaking Changes: Production clients work by default without any code changes
2. Flexible Testing: Test devices can opt into sandbox mode without code deployment
3. Environment Isolation: Sandbox and production data remain completely separate
4. Per-Request Control: Different clients can use different environments simultaneously

curl https://api.example.com/api/credits/balance \
  -H "Authorization: Bearer CUSTOMER_ID"

curl https://api.example.com/api/credits/balance \
  -H "Authorization: Bearer CUSTOMER_ID" \
  -H "X-Environment: SANDBOX"

curl https://api.example.com/api/credits/balance?environment=sandbox \
  -H "Authorization: Bearer CUSTOMER_ID"

Run the test script to verify the changes:

chmod +x test-environment-config.sh
./test-environment-config.sh

1. Production by Default: All requests default to PRODUCTION unless explicitly set to SANDBOX
2. Case Insensitive: Environment values are case-insensitive (sandbox, SANDBOX, Sandbox all work)
3. Data Isolation: Sandbox and production data (subscriptions, credits, grants) are completely isolated
4. Webhook Processing: The webhook stores events with their actual environment, regardless of any configuration