Open source platform for stress free deployments, measured impact, and smarter decisions.

GrowthBook Users

Hi everyone,

I came across <https://linen.growthbook.io/t/16318168/hi-all-i-am-integrating-growthbook-sdk-https-docs-growthbook|this thread> via Google but noticed it’s no longer available in the channel (possibly archived).

I’m seeking clarification regarding the potential risks of exposing the client key in the frontend. The thread mentioned that having access to the client key allows retrieval of feature flags and associated rules. My concern is whether these rules might contain sensitive details, such as customer information or business logic.

Could someone confirm if this is the case? Any guidance would be greatly appreciated!

Thanks in advance!

The client key identifies your SDK end point, and that's public

the API key, that should be kept secret if you created one

you can look at the SDK end point to see what its returning

it will contain the flags, and any rules and targeting conditions

this usually is safe and has no PII - but you can taget to a list of emails, or other PII and that may be exposed. We recommend not doing that or using hashed attributes in those cases