Security
Feature Flag SDK Key Cleanup: Retire Client Keys After Apps Move
Feature flag cleanup usually focuses on old flags in code, but SDK keys deserve their own review. Client-side keys can remain embedded in old mobile apps, browser bundles, desktop releases, or serverless functions. Server-side keys may survive in CI variables after an environment is renamed. When apps move, stale keys can still expose flag state, evaluation paths, or write access depending on how the provider scopes them.
This cleanup helps product engineering and security teams retire flag SDK keys without breaking supported clients.
Identify where the key still runs
Build an inventory by key, environment, app, SDK type, scopes, last evaluation, distribution channel, and owner.
| Key type | Evidence to collect | Cleanup risk |
|---|---|---|
| Mobile client key | Supported app versions and release adoption | Old clients may still evaluate flags |
| Browser key | Bundles, source maps, and deployment history | Public exposure may be expected but stale |
| Server key | CI variables, secrets, and backend deployments | Revocation can break evaluation or writes |
| Environment key | Renamed or retired environments | Cleanup may confuse rollout history |
| Test key | E2E tests and preview deployments | Deleting it can block release validation |
Use provider usage reports and repository search together. A key absent from source may still live in an app already shipped to users.
Do not rush these cases
Slow down when mobile or desktop apps remain supported, because users may run older binaries long after the current release moved. Also slow down when the key has write or admin capability; cleanup may require rotation, not only deletion.
Retire with compatibility in mind
First, move active apps to the current key or environment. Second, reduce scopes for keys that must remain for old clients. Third, monitor evaluation traffic by app version or user agent where possible. Fourth, revoke stale keys after the support window closes and release notes, incident docs, and CI variables are updated.
For public client keys, the cleanup decision is not “was this key visible?” The better question is whether the visible key still maps to an environment and flag set that should exist.
Prevent SDK key drift
When creating a flag key, record whether it is public or secret, which app versions can embed it, what environment it maps to, and how it will be retired. Mobile release checklists should include old key review when flag environments or providers change.
Key takeaways
- Feature flag SDK key cleanup is both configuration cleanup and access cleanup.
- Shipped clients can keep using old keys after source code changes.
- Scope reduction may be safer than immediate revocation.
- New keys need ownership, distribution context, and retirement rules.