If you must use the same account on both environments, hooks could support this? You can pick any hook that fires before Mte.callback gets fired. CMS boot hooks (eg Drupal hook_init) or CRM config hook (hook_civicrm_config) happen early but on many requests so will add overhead; if possible I'd do this as late and specifically as possible - hook_civicrm_apiWrappers could be just the ticket if it works for this usage? Alternatively you could just throw some interception in settings.php / civicrm.settings.php / environment-specific settings.development.php.
That might look like,
// Lives in settings.php so it's not in your committed code.
$mandrill_secrets = [
'development' => 'devkey',
'production' => 'livekey'
];
Boot time: obtain current environment, put in $environment:
- Drupal environment module
strpos($_SERVER['SERVER_NAME'], '.demo.example')- Whatever you want to use ...
Before CiviCRM has a chance to respond to civicrm/ajax/mte/callback: If the supplied secret doesn't match the current environment, unset it or make it invalid.
if (isset($_GET['mandrillSecret']) && $_GET['mandrillSecret'] != $mandrill_secrets[$environment]) {
$_GET['mandrillSecret'] = 'invalid';
}