API reference
Authentication
Dashboard session and SDK key are different credentials.
Last updated on
SDK calls send X-FlagFix-Sdk-Key: {prefix}.{secret}. The server resolves the project, the environment, and the key type. CLIENT_SDK cannot call server-only evaluation. SERVER_SDK should not be embedded in a public client.
Missing or unknown keys return 401. Revoked keys, wrong key type, and inactive environments return 403. The body is application/problem+json.
The dashboard session stays on https://app.flagfix.io. Your applications authenticate with the SDK key header. Do not send the dashboard cookie, and do not put the key in a query string.
Was this page useful?