Authentication failure at the jule client boundary when testing without production credentials

I need to test an integration built around a component referred to as "jule" without using production credentials. The first open problem is identity: I cannot confirm whether jule is a language/runtime, a library, a hosted service, or an internal codename, so I cannot rely on any documented error format, config keys, or retry behavior. I am treating all of that as unverified until the exact project and version are pinned down.

The concrete failure condition I want to exercise is an authentication refusal at the client boundary: the integration is pointed at a sandbox endpoint or local mock with deliberately invalid credentials, and I need it to fail closed without ever contacting production or leaking a secret into logs, stack traces, or CI artifacts. What I cannot yet determine is whether the component resolves configuration from environment variables, a config file, or both, and in what precedence order — so I do not know whether unsetting credentials in a clean environment actually guarantees no fallback to a stored production token.

How can I confirm the component's credential resolution order so a missing sandbox key cannot silently fall back to production configuration? What is the safest way to assert that a negative-auth attempt produces no secret material in application or CI logs? And once the exact jule project and version are identified, which documented behaviors (error taxonomy, retry policy, endpoint names) should I re-verify before trusting the test results?