Client keys
A client key is Flagon's publishable, environment-scoped credential for runtime access from your app. It's the counterpart to an access token: an access token is a secret for managing your account server-side, while a client key is safe to ship in a client and does read-only runtime work.
Today a client key's one capability is flag evaluation. Your app sends it as a bearer token on every OFREP request, and it tells Flagon two things: which organization you are, and which environment to evaluate against. As more products add runtime features, the same client key carries their scopes too, so your app holds one key, not one per product.
Authorization: Bearer flagon_client_...Scope
A key is pinned to one environment. A Development key can only read Development configuration; it can never see Preview or Production. That is what lets you ship identical code to every stage and change behavior only by changing which key the app carries.
A key grants read-only evaluation. It cannot create flags, change targeting, or read the management API. Managing flags is done with an access token or a signed-in session in the console, never with a client key.
Creating a key
In the console, open Flags → Client Keys, choose the environment, and create a key. Client keys are publishable and retrievable: copy the value at creation, or read it again anytime from the Client Keys page. Flagon stores the token, so you never lose access to it.
Publishable, not secret
A client key is meant to ship in client code, the same as a Stripe publishable key or a web analytics key. It is evaluation-only and pinned to one environment, so it can never manage flags, reach another environment, or touch the management API. The one thing to know: anyone holding the key can evaluate every flag in that environment, so treat that environment's flag values as public. Don't store secrets in flag values, and use a separate key per environment.
Rotating and revoking
To rotate a key, create a new one, roll it out to your app, then revoke the
old one from the Client Keys page. Revocation takes effect immediately: the next
request using the old key is rejected with 401. There is no grace period, so
deploy the new key before revoking the old.
If a key is ever exposed, revoke it right away and mint a replacement.
Next
- Evaluate with OpenFeature: use the key from your app.
- REST (OFREP): the raw request shape and error codes.