That error message is exactly what you've mentioned. Basically the key that they are using for access has a whitelist of sites it is allowed to work on, they m

That error message is exactly what you've mentioned. Basically the key that they are using for access has a whitelist of sites it is allowed to work on, they must have forgotten to include the production url to their key. It's a pretty quick fix on their side, somebody who owns that account just needs to add the url. Of course, finding out who owns the account who owns the key might be difficult at VW.