Vortos
Feature Flags

SDK Keys

API keys for SDK clients, CI/CD pipelines, and the management API. Scope keys to projects, environments, and access levels.

SDK Keys

SDK keys authenticate external clients to the feature flags API. They exist for three distinct use cases:

Use caseKey typeAccess
Frontend/mobile SDK reading flagsSDK read keyRead-only, single environment
CI/CD pipeline creating/updating flagsManagement write keyRead-write, scoped project
Monitoring or audit integrationsManagement read keyRead-only, full visibility

Keys are separate from user sessions. They do not expire on logout and are designed to be used by automated systems.

Creating a key

# Read-only key for the @vortos/flags frontend SDK
php vortos vortos:flags:sdk-key:create \
  --name="Web frontend (production)" \
  --env=production \
  --access=read

# CI/CD write key scoped to a project
php vortos vortos:flags:sdk-key:create \
  --name="Checkout team CI" \
  --project=checkout \
  --env=staging \
  --access=read-write

# Management read key with full scope
php vortos vortos:flags:sdk-key:create \
  --name="Audit integration" \
  --access=read \
  --all-projects \
  --all-environments

The command outputs the key once. Store it in your secret manager immediately — it cannot be retrieved again.

Using a key

Pass the key as a Bearer token:

Authorization: Bearer sk-live-abc123...
# Curl example
curl -H "Authorization: Bearer sk-live-abc123" \
  https://yourapp.com/api/flags

# @vortos/flags SDK
<FeatureFlagProvider
  endpoint="/api/flags"
  headers={{ Authorization: `Bearer ${SDK_KEY}` }}
>

For CI/CD pipelines using the management API:

curl -X POST \
  -H "Authorization: Bearer sk-live-abc123" \
  -H "Content-Type: application/json" \
  -d '{"enabled": true, "rollout": 10}' \
  https://yourapp.com/api/flags/management/new-checkout/enable

Listing and revoking keys

# List all active keys (key values are never shown)
php vortos vortos:flags:sdk-key:list

# Revoke a key by ID
php vortos vortos:flags:sdk-key:revoke <key-id> \
  --reason="Team member offboarded"

Revoked keys are recorded in the audit log with the actor and reason. The key stops working immediately — there is no TTL to wait for.

Key scoping

A key's scope limits what it can do:

  • Project scope: A key scoped to checkout cannot read or write flags in billing, even if the bearer has flags.write elsewhere.
  • Environment scope: A key scoped to staging cannot read production flag state.
  • Access scope: A read-only key returns 403 on any write endpoint.

This matters for CI/CD pipelines: a checkout team's CI key cannot accidentally modify a payments flag during a misconfigured deploy script.

Key rotation

Rotate keys regularly or immediately after a suspected leak:

# Create a new key first, update all consumers, then revoke the old one
php vortos vortos:flags:sdk-key:create \
  --name="Web frontend (production) — rotated 2026-06" \
  --env=production \
  --access=read

# After updating consumers
php vortos vortos:flags:sdk-key:revoke <old-key-id> \
  --reason="Scheduled rotation"

Never commit keys to source control

SDK keys in environment variables or a secret manager. Never in .env.example, config/, or any committed file. The platform does not store the raw key value after creation — only a hash — so there is no way to recover a committed key except revocation.

On this page