Environments
Self-service environment switching and promotion is on the LuxID roadmap. Today, promotion of an Application registration from UAT to Production is performed by LuxID when you submit a request to LuxID.
Two independent environments
LuxID runs Production and UAT as fully independent environments that share no data, user accounts, credentials, or configuration.
LuxID operates two fully independent environments: Production and UAT (User Acceptance Testing). Independent means exactly that - the two environments share no data, no user accounts, no credentials, and no configuration.
| Production | UAT | |
|---|---|---|
| Login endpoint | https://login.luxid.lu | https://login-uat.luxid.lu |
| Account portal | https://account.luxid.lu/ | |
| Discovery document | https://login.luxid.lu/.well-known/openid-configuration | https://login-uat.luxid.lu/.well-known/openid-configuration |
| Authorisation endpoint | https://login.luxid.lu/mga/sps/oauth/oauth20/authorize | https://login-uat.luxid.lu/mga/sps/oauth/oauth20/authorize |
| Token endpoint | https://login.luxid.lu/mga/sps/oauth/oauth20/token | https://login-uat.luxid.lu/mga/sps/oauth/oauth20/token |
| Purpose | Live traffic from real users | Integration, QA, load testing, partner acceptance |
| User accounts | Real end-user accounts | Test accounts only |
| Rate limits | Standard production limits | Lower than production - see note below |
| Data residency | Luxembourg / EU | Luxembourg / EU |
What "independent" means in practice
Separate Partner and Application registrations
When your organisation is onboarded as a LuxID Partner, you receive separate Partner records in Production and UAT. The Client IDs and Client Secrets issued in each environment are different. A credential valid in UAT will not work in Production, and vice versa.
This separation is intentional. It prevents test traffic from appearing in production logs and production credentials from leaking into test tooling.
Separate user populations
A test user account created in UAT does not exist in Production. There is no synchronisation between the two user stores. End users who have real LuxID Accounts in Production cannot use those accounts to log in to an application that is connected only to UAT.
For test user management in UAT, see Test users and simulation.
Separate Spheres
Sphere assignments are also independent per environment. The sub claim generated for a given user in UAT will not match the sub for the same user in Production, even if that user exists in both environments. Do not assume that sub values are portable across environments.
Rate limits
UAT operates at lower rate limits than Production. This is deliberate - UAT is not dimensioned for production-scale traffic and should not be used for performance or load testing at production volumes.
If your load test or performance test generates sustained high request volumes, contact LuxID in advance. Running unexpected high-volume traffic against UAT may result in temporary throttling.
Promoting an Application from UAT to production
Running in UAT first is strongly recommended before going live in Production. Once you have validated your integration in UAT, the promotion process creates a corresponding Application in Production.
The current process is:
- Confirm your UAT Application is fully configured and tested - redirect URIs, Claim Templates, Groups, and branding are all set correctly.
- Contact LuxID with the subject line "Production promotion request: [Application Name]". Include the UAT Client ID and the target go-live date.
- The LuxID operations team will create the Production Application, assign it to your Partner, and issue Production credentials.
- You will receive a new Client ID and Client Secret for the Production Application. These are different from the UAT credentials.
- Update your Production deployment configuration with the Production credentials and the Production LuxID endpoints.
- Perform a smoke test in Production before announcing the go-live to users.
Self-service promotion via the Console may be introduced in a future release.
What is not copied automatically during promotion
The following must be verified or re-applied manually after promotion:
- Redirect URIs - confirm the Production URIs are registered on the Production Application (the UAT URIs will differ).
- Domain verification - if your Production domain was not already verified during onboarding, complete verification before promotion.
- Branding assets - logos and display names must be uploaded again in Production if they were only configured in UAT.
- Client Secret storage - update your Production secrets manager with the new Production secret.
You cannot re-use UAT credentials in production
Even if you could technically point UAT credentials at Production endpoints, do not do this. Credentials are bound to the environment in which they were issued. Mixing environment credentials is an operational anti-pattern that makes incident response harder and audit trails unreliable.
Data residency
Both Production and UAT environments are hosted within the European Union, on POST infrastructure. User data processed by LuxID does not leave the EU. Where sub-processors deliver SMS, voice calls or emails on LuxID's behalf, they receive only the data needed for that task (such as the destination number or email address) under a GDPR data-processing agreement, and process it within the EU.
For compliance documentation related to data residency and GDPR, see Governance, trust and compliance.
Recommended workflow
A robust pre-production workflow for a new Application integration:
- Register the Application in UAT and obtain UAT credentials.
- Implement the integration in your development environment using UAT endpoints.
- Create test users in UAT with the configurations relevant to your use case (see Test users and simulation).
- Run integration tests, UAT acceptance tests, and a security review.
- Request Production promotion via LuxID.
- Configure Production credentials in your secrets manager.
- Perform a Production smoke test with a small group of real users before full rollout.
Keep your UAT Application active after go-live. It serves as the target for future feature development, regression testing, and incident reproduction.
For testing tooling and test scenario setup, see Testing and tooling.