For production, do not set ZESTY_HOST. The provider defaults to the production Zesty API.
If validation fails with 403 Forbidden, check for stale environment variables:
env | grep '^ZESTY_'
For production, remove any host override and keep only the API token:
unset ZESTY_HOST
export ZESTY_API_TOKEN="<your-zesty-api-token>"