I have a webapp (SPA) that can work in a web browser along with my iOS and Android app webviews. I need a way to activate what I call a DEV or DEBUG mode, in order to:

• Target another API (test API for example or plug the test webapp to the prod API)
• Change the log level and send logs to a server so I can see what is going on internally
• Display extra functionality such as experimental features
• I could direct a calling customer to activate those features and help him debug his app
• Probably more to come

What I proposed my boss is to have some kind of a cheat code, much like the 8 taps on the version number to activate debug mode on Android. You would enter “SECRET_CODE” in the login field and triple click on login and it would show a menu to activate those things for example. He doesn’t like the idea too much citing security concerns.

Is my idea so dumb? Is there best practices around this kind of stuff?