SDK credentials

This topic explains how to view, copy, rotate, create, and delete SDK credentials and environment keys. SDK credentials authenticate your applications to LaunchDarkly and determine which environment your SDK connects to. Each environment has three types of credentials, and which one you need depends on which SDK you use:

• SDK keys: Use with server-side and AI SDKs. Keep SDK keys secret. You can rotate an SDK key if it’s exposed. SDK keys always start with the prefix sdk-.
• Mobile keys: Use with client-side SDKs designed for mobile. Mobile keys do not need to be kept secret, but you can rotate them if needed. Mobile keys always start with the prefix mob-.
• Client-side IDs: Use with JavaScript-based client-side SDKs and edge SDKs. Client-side IDs do not need to be kept secret and cannot be rotated. Client-side IDs are alphanumeric and do not contain dashes.

To learn more about different SDK key types, read About the different types of SDKs and Keys. You can view, copy, and reset SDK credentials from the SDK keys page under Organization settings. All plans can create and manage multiple SDK keys and multiple mobile keys per environment at the same time. Serving those keys concurrently through the Relay Proxy is a separate capability. To learn more, read Multiple SDK credentials for multiple applications. Customers that use the views feature can optionally add filters to SDK payloads. To learn more, read Filtered SDK payloads.

​

View or copy SDK credentials

To view or copy an SDK key, mobile key, or client-side ID:

1. Click the gear icon in the left sidebar to open Organization settings.
2. Under the “Security” section, click SDK keys. The SDK keys page appears.
3. Use the menus to search for and select the project and environment for which you want to view or copy a credential.
4. To reveal an SDK key, click the eye icon.
5. Click the clipboard icon to copy a credential to your clipboard.

​

Rotate SDK credentials

To rotate an SDK key or mobile key, first create a new key, then delete the old key after you have fully moved your application to the new key. You can also set an expiry on a key at any time, as long as the environment always has at least one active server-side SDK key and one active mobile key.

​

Best practices for rotating SDK keys

Client-side IDs and mobile keys do not need to be rotated because they do not need to be kept secret. Rotate SDK keys in the following situations:

• The SDK key is exposed: Create a new SDK key and move your applications to it as soon as possible.
• On a regular cadence: Rotating SDK keys regularly reduces the risk of an undetected exposure.

To rotate a key, follow these steps:

1. Inventory all places where the key is used, such as apps, services, Kubernetes secrets, CI/CD tools, and the Relay Proxy.
2. Create a new SDK key.
3. Optionally set an expiration date for the old key.
4. Update all apps, services, secrets, and tools with the new key. Both the old and new keys work until you delete the old key or it expires.
   • For a manually configured Relay Proxy, update the relay config with the new key and restart the relay so it re-authenticates.
   • For a Relay Proxy using automatic configuration, the proxy detects the new default key automatically during rotation and switches over without a manual restart. This is separate from running multiple concurrent keys through the Relay Proxy. To learn more, read Multiple SDK credentials for multiple applications.
5. Verify that your apps are successfully connecting to LaunchDarkly.
6. Delete the old key, or let the expiration date pass.

After the old key is deleted or expired, any SDKs still using it fail authentication and feature flag evaluations return fallback values defined in your code.

​

Multiple SDK credentials for multiple applications

When you manage multiple applications within the same environment, you can generate and manage distinct SDK credentials for each application. Isolating credentials per application limits the impact of accidental exposure, since only the applications using that key are affected. To move an application to a new SDK key, create the new key first, update your application, then delete the old key only after you have confirmed you no longer need it.

​

Create SDK credentials

To create a new SDK key or mobile key:

1. Click the gear icon in the left sidebar to open Organization settings.
2. Under the “Security” section, click SDK keys. The SDK keys page appears.
3. Use the menus to search for and select your project and environment.
4. Click New SDK key or New mobile key.
5. Enter a Name.
6. (Optional) Edit the automatically-generated Key. You cannot reuse these, even if you delete the old key or it expires.
7. (Optional) Enter a Description.
8. (Optional) Click Custom payload to enable filtering.
   • Click Add views.
   • Select the views to filter the payload by.
9. Click Generate key.

You cannot create new client-side IDs.

​

Delete SDK keys

Before you delete an SDK key, confirm that none of your applications use the key. Deleting a key that is still in use causes those applications to fail authentication and return fallback values. To delete an SDK key or mobile key:

1. Click the gear icon in the left sidebar to open Organization settings.
2. Under the “Security” section, click SDK keys. The SDK keys page appears.
3. Use the menus to search for and select your project and environment.
4. Click the three-dot overflow menu next to the SDK key or mobile key you want to delete.
5. Select Delete key.
6. Enter the environment name to confirm.
7. Click Delete key.

You cannot delete client-side IDs. When you delete an SDK key or mobile key, you cannot reuse the key for the credential for 180 days.

​

Set expiration dates for SDK keys

Setting an expiration date on an SDK key or mobile key lets you plan ahead for key rotation without needing to manually delete the key later. The key remains active until the expiration date, giving you time to update your applications before it stops working. To set an expiration date:

1. Click the gear icon in the left sidebar to open Organization settings.
2. Under the “Security” section, click SDK keys. The SDK keys page appears.
3. Use the menus to search for and select the project and environment for which you want to set an expiration date.
4. Click the three-dot overflow menu next to the SDK key or mobile key you want to set an expiration date for.
5. Select Set expiration.
6. Enter an expiration date and time.
7. Enter the environment name to confirm.

You cannot set expiration dates for client-side IDs.

​

View expired SDK keys

To view an expired SDK key:

1. Click the gear icon in the left sidebar to open Organization settings.
2. Under the “Security” section, click SDK keys. The SDK keys page appears.
3. Use the menus to search for and select the project and environment for which you want to view an expired key.
4. Click N expired SDK keys. A new section appears.
5. Click the eye icon to reveal the SDK key.