navan-multi-env-setup

# Navan Multi-Environment Setup ## Overview Navan does not offer a sandbox or staging API — every call hits production data with real corporate bookings and expense records. This creates risk for development and testing: a bug in a sync script could modify live itineraries, and CI pipelines cannot safely run integration tests. This skill implements environment isolation using separate OAuth apps, environment variable validation, a local development proxy, and a CI mock server. ## Prerequisites - Navan admin access to create multiple OAuth apps (Admin > Travel admin > Settings > Integrations) - Node.js 18+ for proxy and mock server - Understanding of OAuth 2.0 client credentials flow (see `navan-install-auth`) - `.env` management tooling (dotenv, direnv, or cloud secret manager) ## Instructions ### Step 1: Create Per-Environment OAuth Apps Create separate API credentials in the Navan admin dashboard for each environment. This provides natural isolation — the dev app can have read-only scopes while production gets full access. ```bash # .env.development — read-only scoped OAuth app NAVAN_ENV=development NAVAN_CLIENT_ID=dev-client-id-xxxxx NAVAN_CLIENT_SECRET=dev-client-secret-xxxxx NAVAN_API_BASE=https://api.navan.com/v1 NAVAN_READ_ONLY=true # .env.staging — read + limited write, separate audit trail NAVAN_ENV=staging NAVAN_CLIENT_ID=stg-client-id-xxxxx NAVAN_CLIENT_SECRET=stg-client-secret-xxxxx NAVAN_API_BASE=https://api.navan.com/v1 NAVAN_READ_ONLY=false # .env.produc...