Management API
SDK keys
List, create and revoke the server and client keys of an environment.
Server keys (rk_srv_) read the environment’s full snapshot; client keys (rk_cli_) only get evaluated values for client-enabled flags, from allowed origins. The secret is returned once at creation and only its SHA-256 is stored.
A revoked key stops working on delivery within the key cache lifetime (30 seconds by default).
Operations
| Operation | Request | Who may call it |
|---|---|---|
| listSdkKeys | GET /api/orgs/{org}/projects/{project}/environments/{env}/sdk-keys | developer or above |
| createSdkKey | POST /api/orgs/{org}/projects/{project}/environments/{env}/sdk-keys | admin or above |
| revokeSdkKey | DELETE /api/orgs/{org}/projects/{project}/environments/{env}/sdk-keys/{id} | admin or above |
Management API requests carry a user token and are checked against the caller’s organization role. Delivery API requests carry an SDK key; the two never cross. Errors are always { error: { code, message } }.