Environments and SDK keys

Providers read an environment’s flags from https://flags.ezghcloud.com with one of the environment’s SDK keys. A key names the organization, project and environment, so it’s the only setting a provider needs.

	Server key	Client key
Looks like	`ezgh_fs_` and 43 letters and digits	`ezgh_fc_` and 43 letters and digits
Secret?	Yes: keep it in your backends’ secrets	No: publishable, it ships in web pages
Reads	Every flag, with its rules (providers evaluate locally)	Client-side flags only, evaluated on EZGH’s servers; never their rules
Used by	Server providers (Node, Bun, Deno, Go, Python)	The web provider, and OFREP providers in browsers and apps

A client key asking for a flag that isn’t client-side gets FLAG_NOT_FOUND, exactly as for a flag that doesn’t exist.

Creating a key

In the console, open the environment under Feature Flags › Environments and choose Create SDK key. With the CLI:

export EZGH_FLAGS_SDK_KEY=$(ezgh flags keys create --env production --kind server --name checkout-api)

The key is shown once, when it’s created; Feature Flags keeps only its hash and its first 12 characters (its prefix, ezgh_fs_Ab3d), which lists show. A create retried with the same Idempotency-Key answers the key’s metadata with key: null.

Keys belong to the environment, not to who made them: they keep working when that person leaves the organization.

Revoking a key

Revoke a key from the environment’s SDK keys tab, or with ezgh flags keys revoke <prefix, name or ID> --env production. It stops working within seconds: evaluations answer 401, and its open streams end. A key also stops working when its environment, project or organization is deleted.

To rotate a key, create a new one, deploy it, then revoke the old one.

Environments

Create environments in the console (a project without any offers to create production and development), or with ezgh flags envs create staging. Deleting an environment revokes its keys and deletes every flag’s targeting and history there.

Exporting

ezgh flags export --env production > flags.json writes an environment’s flags as flagd’s flag-definition JSON, which server providers can start from (bootstrapPath) or run on without the network (offline), and which flagd itself serves. It needs flags.environments.export. Right after an environment is created its flags are compiled within moments; until then, export answers 503 snapshot_pending with Retry-After (the CLI waits and retries).