Hi all, I am integrating GrowthBook SDK (java sdk) with my spring boot web-application. I am curious if client key is supposed to treated as secret or not. Basically, i am using only in backend-side and no users can access this key but I just want to make sure I treat this key correctly (e.g. save it in secrets manager).

not super secret - it will decrypt attributes, so on the server its not strictly necessary.

Can you clarify more about "not super secret" ? It is still secret but just not really sensitive ?

The client­_key is not required to be treated as a secret key and it is OK to expose the client­_key on the client side. However, the client key will allow users to see your feature flag list and rules. If you want to add an extra layer of security, you can encrypt the /features endpoint for a given API key to make it harder for someone to access the feature flag list and rules. The encrypted features would need to be decrypted on the client side using a decryption key. https://docs.growthbook.io/app/api#encryption

Thank you. This helps a lot! I'll look into encryption.