Server-side testing

A server key, prefixed sdk_server_, reads every flag in the project. It must never reach a browser. That access is what lets a backend-only flag gate an unshipped API, a schema migration, or a pricing rule while both its name and its payload stay private. The SDK overview sets the two key types out side by side.

The assignment is made once, in a place you control, on data you already hold. Nothing flashes the wrong variation while a client bootstraps, because the response arrives already decided. Attributes that never reach the browser can drive the rule, which covers most of the interesting ones, from an account's contract value to an internal risk tier. The trade-off shows up when a change affects only rendering, because deciding it still costs a request, so teams commonly evaluate on the server and pass the result down to the client rather than deciding it twice.