Operating

Testing

Test keys read real data, write no evidence, and let you force either answer.

A gk_test_… key is not a sandbox with fake data. It hits the same database and returns the same truth — it simply refuses to write usage evidence, so wiring up an integration never pollutes anyone's Qualified Active Days or the pool.

Forcing an answer

Both branches of your gate need testing, and buying your own product to test the happy path is a poor use of an afternoon:

bash

# force an active entitlement
curl -s "$GUIRU/api/v1/entitlements?user_id=$ANY_UUID" \
  -H "Authorization: Bearer gk_test_…" \
  -H "X-Guiru-Test-Entitlement: active"

# force the locked path
curl -s "$GUIRU/api/v1/entitlements?user_id=$ANY_UUID" \
  -H "Authorization: Bearer gk_test_…" \
  -H "X-Guiru-Test-Entitlement: none"

The header is honoured only for test keys; on a live key it is ignored, not an error. Every response carries test_mode, so an integration can refuse to run in production against a test key rather than quietly serving a forced answer to real people.

Webhooks, locally

Deliveries only go to public URLs, so point the endpoint at a tunnel while developing. The console lists the last deliveries with status code and error, which is usually faster than reading your own logs to find out whether the problem is you or us.