Several environments use the same REST API but different hosts and credentials. What is a sound configuration approach?

1. Duplicate the database for every REST request
2. Put credentials into public navigation URLs
3. Separate environment-specific endpoints and protected credentials from application logic
4. Hardcode production passwords into every page's JavaScript