Flagsmith 401 invalid environment key in CI

By Kaveh Alemi·Latchkey

Flagsmith rejected the request because the environment key was missing or invalid. The API is reachable; the key you passed to the client is empty, mistyped, or a server-side key used where a client-side one is expected (or the reverse).

What this error means

Flagsmith returns HTTP 401 with a body like {"detail":"Invalid or missing environment key"} and the SDK cannot fetch flags, falling back to defaults or raising.

flagsmith.exceptions.FlagsmithAPIError: 401 Client Error for
https://edge.api.flagsmith.com/api/v1/flags/
{"detail":"Invalid or missing environment key"}

Common causes

The environment key is empty or not injected into CI

The secret was not exposed to the job, so the client is built with an empty key and Flagsmith returns 401.

Wrong key type for the SDK (server vs client-side)

Server-side SDKs need the server-side environment key; passing the client-side key (or the reverse) yields an invalid key error.

How to fix it

Inject the correct environment key from a secret

1. Copy the environment key from Flagsmith under the environment settings.
2. Store it as a CI secret and pass it to the client as an env var.
3. Match the key type to the SDK: server-side key for server SDKs.

env:
  FLAGSMITH_ENVIRONMENT_KEY: ${{ secrets.FLAGSMITH_ENVIRONMENT_KEY }}

Point the SDK at the right API URL

If you use Edge or a self-hosted instance, set the api_url so the key is validated against the correct backend.

flagsmith = Flagsmith(
    environment_key=os.environ["FLAGSMITH_ENVIRONMENT_KEY"],
    api_url="https://edge.api.flagsmith.com/api/v1/",
)

How to prevent it

• Keep the Flagsmith environment key in CI secrets, never committed.
• Use a dedicated CI environment key so production flags stay isolated.
• Match the key type to the SDK flavour (server-side vs client-side).

Frequently asked questions

Related guides

References

• GitHub Actions documentation