Core concepts
The vocabulary you will see across the dashboard and API.
App
The unit of ownership. Everything — devices, flags, controls, keys, rules — is scoped to one app.
Environment
A logical partition inside an app, typically Test and Production. Each environment has its own API keys, so a Test key cannot see or change Production.
Device
One installation of your app. Identified by a device_uid you generate on the client and keep stable (a UUIDv4 stored in secure storage is enough). The server upserts the device on register and updates its last-seen data on session.
Feature flag
A named toggle with a default treatment and optional targeting rules. Flags are evaluated locally by the SDK against the ruleset served by /flags/ruleset.
UI control
A server-owned value your UI reads by key — text, image URL, link, variant, JSON. Resolved per device by /controls so targeting and killed-payloads are enforced on the server, never in the client.
Segment
A reusable audience built from device attributes and tags.
Block rule
A server-side rule that blocks or forces update for matching devices. Returned by /session and cached offline by the SDK.
Publishable key
The client-safe credential that identifies your app to the public API.
Signing secret
A per-key secret used for HMAC-signed requests. Server-to-server only — never ship it in a mobile or browser binary. See Authentication.