API keys

FujiFlag SDKs read flag values with an environment API key. The key determines which environment’s values are returned.

When to use this guide

Use this guide before connecting an SDK to a deployment environment or when you need to replace a key that may have been exposed.

Before you begin

Select the project and environment that the application should read from. A key for staging must not be used by production, even if both applications use the same flag keys.

Use one key per environment

Create different keys for development, staging, and production. This prevents a staging deployment from accidentally reading production values and makes a rotation smaller in scope.

Keep keys out of source control

Store the key in the deployment environment’s secret manager or environment configuration. Do not commit it to a repository, include it in screenshots, or share it in support requests.

Rotate exposed keys

If a key is exposed, create a replacement, update the affected deployment, and then revoke the old key. Check that the new deployment can read expected values before revoking the previous key.

Verify the replacement

Deploy the replacement key to the intended environment and evaluate a known flag. Confirm the response contains that environment’s value before revoking the old key.

Use the right key in browser applications

Browser applications need a read key intended for that environment. Never embed an account session credential or a key with write access in client-side code.