Resources
Security
How to handle SDK keys in your applications.
Last updated on
Store server keys in a secret manager. Rotate, deploy the new key, then revoke the old one. Treat client keys as public: anyone who can read the bundle can use them. A client key must be a CLIENT_SDK key, and it must not be used for server-side evaluation.
Do not put secrets in flag values. evaluate-public returns those values to the browser.
Report vulnerabilities through Support.
Was this page useful?