doesn't manage tokens and permissions when environment variable isn't production