Skip to main content
All requests to /v1/* must be authenticated. Feather Flag supports two authentication methods: API keys for programmatic API clients, and session cookies for dashboard browser traffic.

​
API Keys

Pass your key in the Authorization header:

​
Key types

Never expose a server key in client-side code or public repositories.

​
Creating a key

Keys are scoped to a specific environment. See Create API Key.

​
Key lifecycle

  • Keys are active until explicitly revoked.
  • Revoking a key is immediate and permanent — a revoked key cannot be re-activated.
  • The raw key value is returned once at creation. Feather Flag stores only a SHA-256 hash.
  • The keyPrefix (e.g. sk_ab12...) is always available for display purposes.

​
Session Authentication (Dashboard)

The web dashboard authenticates via GitHub OAuth. Session tokens are stored in HTTP-only cookies and are not usable for API access outside the browser. Session authentication is intended for same-origin dashboard requests. External clients and integrations should use API keys in the Authorization header. CSRF protection is enforced on all session-authenticated mutating requests (POST, PUT, PATCH, DELETE). The Origin or Referer header must match the expected origin.

​
Error responses