> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.fujiflag.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.fujiflag.com/_mcp/server.

# API keys

> Use environment-scoped read API keys safely.

# API keys

FujiFlag SDKs read flag values with an environment API key. The key determines
which environment's values are returned.

## When to use this guide

Use this guide before connecting an SDK to a deployment environment or when you
need to replace a key that may have been exposed.

## Before you begin

Select the project and environment that the application should read from. A key
for staging must not be used by production, even if both applications use the
same flag keys.

## Use one key per environment

Create different keys for development, staging, and production. This prevents a
staging deployment from accidentally reading production values and makes a
rotation smaller in scope.

## Keep keys out of source control

Store the key in the deployment environment's secret manager or environment
configuration. Do not commit it to a repository, include it in screenshots, or
share it in support requests.

## Rotate exposed keys

If a key is exposed, create a replacement, update the affected deployment, and
then revoke the old key. Check that the new deployment can read expected values
before revoking the previous key.

## Verify the replacement

Deploy the replacement key to the intended environment and evaluate a known
flag. Confirm the response contains that environment's value before revoking the
old key.

## Use the right key in browser applications

Browser applications need a read key intended for that environment. Never embed
an account session credential or a key with write access in client-side code.