I am sure there is a best-practice way to handle this, but I don't know what it is...
The situation is that I am about to submit my Salesforce package for security review. The package works by requiring an admin to grant OAuth permissions to an external web service (my site) on behalf of users in their org. When users use the plugin, it sends a signed post request to an endpoint on our site, and our endpoint responds with a page to embed in a Salesforce Canvas. My question is, what URL do I put for the external endpoint: staging or production?
If I put the staging url, then after the security team reviews the app, I'll need to re-release the managed package (since I can't edit already released packages) to point at the production domain rather than the staging domain. And if I put the production url on the first go, then the security team will be testing the plugin against our production server, which also doesn't feel quite right.
What is the proper way to handle this?