403 "Invalid Application-ID or API key" when pointing Algolia client at a test index in the production app

Our team needs to test an Algolia search integration without using production credentials or touching production data. When we configure the client with a mismatched app ID and key pair, the API responds with a 403 "Invalid Application-ID or API key" error, so anonymous or partially correct credentials are not an option — a valid pair is mandatory.

Two isolation approaches are on the table. Option one: create a separate free sandbox application with its own app ID, indices, and keys, and switch the client via environment variables. Option two: keep one production application but use a dedicated test index, with a secured API key using restrictIndices to limit access to that index only.

The trade-offs are unclear. A sandbox app fully isolates credentials and analytics, but the free tier's record and operation limits may distort pagination and performance behavior compared with our paid production plan. A separate index in the production app shares quotas and keys, and a misconfigured admin key could write test data into production indices.

Which approach is considered safer for backend indexing tests that require an admin key? Does restrictIndices on a secured key reliably prevent cross-index writes, or only searches? Are there documented behavioral differences between free-tier and paid apps that would invalidate integration test results?