Launch keys
Every SDK request carries one key. There are two kinds, and the kind decides what the key may see: the control plane refuses to serve rules to a client key, and refuses a server key presented from a browser or app.
| Server key: evk_… | Client key: evk_pub_… |
|---|---|
| Receives the environment’s full ruleset and evaluates locally. For Node.js, edge runtimes, Python, Go, Ruby, Rust and JVM servers. | Receives evaluated values for one context: never targeting rules. For browsers, iOS, Android, React Native and Flutter. |
| A secret. It discloses every flag and segment, so it must never ship in a browser bundle or a mobile app. | Safe to embed: it answers only for the origins or app ids you allow, and only with values a user could observe anyway. |
Sent as Authorization: Bearer evk_… with no Origin or x-evolve-app-id header. | Browsers send their own Origin automatically; native apps send x-evolve-app-id: <appId>. |
Allowing an origin
A client key only answers from origins you allow. In e-volv, open the project, choose Access on the environment, and add https://app.example.com - scheme, host and port, no path. A request from any other origin is refused with 403; the SDK logs once naming the origin and keeps serving defaults. The same Access action manages the app ids native apps may present.
Rotating a key
Key plaintext is shown exactly once, at creation. Rotating replaces the key: the old key stops working at once on the instance that rotated it and within 60 seconds everywhere else. Plan a deploy of the new key before rotating if your services cannot all restart together.
Scopes
Reading flags requires the flags:read scope. A key without it is answered 403 "lacks the scope flags:read" and the SDK disables flags with one warning while telemetry keeps working. Observer keys carry logs:write; one key can carry both scopes so a service uses a single init for telemetry and flags.
# Verify a key end to end (never on a hot path)
curl -s "https://api.e-volv.io/api/public/v1/flags/ping" \
-H "Authorization: Bearer evk_..."
# 200 { "environment": "production", "keyKind": "server", "flags": 4, "etag": "…" }