FlagPilot provides a Secret API Key for trusted servers, CLI/API scripts, and MCP, plus a Client SDK Key for browser applications. Select Development, Staging, or Production with the SDK environment option.
Key Credentials & Usage
Each project exposes two key types and the environment is selected explicitly in configuration:
- 🔑Secret API Key (
fk_secret_...) — For trusted servers, CLI, MCP, and REST API calls. - 🔑Client SDK Key (
fk_client_...) — For browser JavaScript, React, and client-rendered Next.js usage. - 🔑Environment option — Use
development,staging, orproductionper SDK instance.
Key Rotation and Propagation
If an API key is accidentally exposed, you can rotate the key from the Project Settings panel:
- Navigate to the **Settings** view in your dashboard.
- Locate the target key block and click **Rotate Key**.
- Confirm the action. The old key remains active for a 15-minute grace period to prevent downtime before being permanently revoked.
FAQ
How does API Keys & Rotation interact with local caches?
Configurations are synced down using Edge Config or fallback REST triggers. The client automatically reads evaluations in-memory, resulting in sub-millisecond local evaluation times.
Where can I obtain support for API Keys & Rotation?
You can open a support ticket in your dashboard, check the community roadmap, or consult the FlagPilot Platform Status page.