---
title: "Environments and SDK keys"
description: "Server and client SDK keys, what each can read, and revoking them."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Environments and SDK keys

Providers read an environment's flags from `https://flags.ezghcloud.com` with one of the
environment's **SDK keys**. A key names the organization, project and environment, so it's the
only setting a provider needs.

| | Server key | Client key |
| --- | --- | --- |
| Looks like | `ezgh_fs_` and 43 letters and digits | `ezgh_fc_` and 43 letters and digits |
| Secret? | Yes: keep it in your backends' secrets | No: publishable, it ships in web pages |
| Reads | Every flag, with its rules (providers evaluate locally) | Client-side flags only, evaluated on EZGH's servers; never their rules |
| Used by | Server providers (Node, Bun, Deno, Go, Python) | The web provider, and OFREP providers in browsers and apps |

A client key asking for a flag that isn't client-side gets `FLAG_NOT_FOUND`, exactly as for a flag
that doesn't exist.

## Creating a key

In the console, open the environment under **Feature Flags › Environments** and choose **Create SDK
key**. With the CLI:

```sh
export EZGH_FLAGS_SDK_KEY=$(ezgh flags keys create --env production --kind server --name checkout-api)
```

**The key is shown once**, when it's created; Feature Flags keeps only its hash and its first 12
characters (its prefix, `ezgh_fs_Ab3d`), which lists show. A create retried with the same
`Idempotency-Key` answers the key's metadata with `key: null`.

Keys belong to the environment, not to who made them: they keep working when that person leaves
the organization.

## Revoking a key

Revoke a key from the environment's **SDK keys** tab, or with
`ezgh flags keys revoke <prefix, name or ID> --env production`. It stops working within seconds:
evaluations answer `401`, and its open streams end. A key also stops working when its environment,
project or organization is deleted.

To rotate a key, create a new one, deploy it, then revoke the old one.

## Environments

Create environments in the console (a project without any offers to create `production` and
`development`), or with `ezgh flags envs create staging`. Deleting an environment revokes its keys
and deletes every flag's targeting and history there.

## Exporting

`ezgh flags export --env production > flags.json` writes an environment's flags as
[flagd](https://flagd.dev)'s flag-definition JSON, which server providers can start from
(`bootstrapPath`) or run on without the network (`offline`), and which flagd itself serves. It
needs `flags.environments.export`. Right after an environment is created its flags are compiled
within moments; until then, export answers `503 snapshot_pending` with `Retry-After` (the CLI waits
and retries).

Source: https://docs.ezghcloud.com/flags/environments-and-keys/index.mdx