flaggr manages Flaggr feature flags from your terminal: sign in through your browser, list, create, toggle and delete flags, evaluate them over Connect-RPC, follow flag updates as they happen, and read evaluation metrics, health scores, the audit log and a project's exported configuration.
Documentation: flaggr.dev/docs/getting-started/cli
curl -fsSL https://raw.githubusercontent.com/flaggr-dev/flaggr-cli/main/install.sh | shThe script downloads the latest release for your OS and architecture, checks it against the release's checksums.txt, and installs flaggr to /usr/local/bin, with sudo when that directory isn't writable. Set FLAGGR_INSTALL_DIR to install somewhere else, and FLAGGR_VERSION to install a given release:
curl -fsSL https://raw.githubusercontent.com/flaggr-dev/flaggr-cli/main/install.sh | FLAGGR_INSTALL_DIR="$HOME/.local/bin" FLAGGR_VERSION=0.5.0 shEach release has an archive for macOS (darwin), Linux (linux) and Windows (windows, a .zip), on amd64 and arm64, named flaggr_<version>_<os>_<arch>, and checksums.txt with their SHA-256 sums. For example, on an Apple Silicon Mac:
curl -fsSLO https://github.com/flaggr-dev/flaggr-cli/releases/download/v0.5.0/flaggr_0.5.0_darwin_arm64.tar.gz
curl -fsSLO https://github.com/flaggr-dev/flaggr-cli/releases/download/v0.5.0/checksums.txt
shasum -a 256 --check --ignore-missing checksums.txt # on Linux: sha256sum --check --ignore-missing checksums.txt
tar -xzf flaggr_0.5.0_darwin_arm64.tar.gz flaggr
sudo install -m 0755 flaggr /usr/local/bin/flaggrWith Go 1.27 or later:
go install github.com/flaggr-dev/flaggr-cli/cmd/flaggr@latestThis builds flaggr into $(go env GOPATH)/bin. flaggr --version reports the module version you installed.
flaggr login # opens your browser to sign in
flaggr status # CLI and server versions, API health
flaggr projects # the projects you can access
flaggr flags list --project <project-id>
flaggr eval bool --key checkout-v2 --service <service-id>flaggr login opens your browser at flaggr.dev. Once you're signed in, choose One project, a project API token (read & write) for the project you pick, or All my projects, a personal access token that acts as you in every project you can access. The sign-in page posts the token to the CLI's callback on 127.0.0.1, never in a URL, along with a one-time state the CLI checks. The CLI saves the token in ~/.flaggr/config.json, readable only by you.
Browser sign-in and personal access tokens need Flaggr 0.5.0 or later on the server: flaggr status shows its version. An older sign-in page creates a project API token named "CLI login (date)" and puts it in the callback URL, where your browser history keeps it, so flaggr login doesn't save it and tells you so in your terminal. Revoke that token in the project's Settings → API tokens, then create a project API token there and run flaggr login --token fgr_....
A One project token can't delete: flaggr flags delete gets 403 with it. For deletes, choose All my projects, or pass a token that has the Delete permission to flaggr login --token.
In CI and other places without a browser, pass a token, or set FLAGGR_API_TOKEN, which takes precedence over the saved token:
flaggr login --token fgp_your_personal_access_token # or a project API token (fgr_...)flaggr eval calls the SDK evaluation endpoints, which accept project API tokens only. With a personal access token saved, pass a project token for the call: FLAGGR_API_TOKEN=fgr_your_project_token flaggr eval bool --key checkout-v2 --service <service-id>.
flaggr logout deletes ~/.flaggr/config.json. It doesn't revoke the token: a personal access token works until it expires or you revoke it under Profile → Personal access tokens, and a project API token until you revoke it in the project's Settings → API tokens.
| Command | What it does |
|---|---|
flaggr login, flaggr logout |
Sign in, or delete the saved credentials |
flaggr status |
CLI and server versions, and the API's health |
flaggr projects |
List the projects you can access |
flaggr services --project <id> |
List a project's services |
flaggr flags list --project <id> |
List flags, optionally only a --service's or an --environment's |
flaggr flags create --key <key> --name <name> --service <id> |
Create a flag: --type (boolean, string, number or object), --default, --enabled |
flaggr flags toggle --key <key> --service <id> |
Turn a flag on or off |
flaggr flags delete --key <key> --service <id> |
Delete a flag |
flaggr flags stale --project <id> |
Flags that haven't been evaluated recently |
flaggr eval bool --key <key> --service <id> |
Evaluate a flag over Connect-RPC (also eval string and eval number), with --context '{"targetingKey":"user-123"}' |
flaggr eval config --service <id> |
A service's flag configuration |
flaggr eval stream --service <id> |
Follow flag updates as they happen |
flaggr metrics flag --key <key> --service <id> |
A flag's evaluations, errors and latency over a --range |
flaggr metrics watch --key <key> --service <id> |
A flag's live evaluation rate |
flaggr metrics heatmap --project <id> |
Evaluations across a project's flags |
flaggr health flag --key <key> --service <id> |
A flag's health score |
flaggr health project --project <id> |
A project's health |
flaggr audit log --project <id> |
The project's audit log, with diffs |
flaggr audit history --key <key> --service <id> |
A flag's version history |
flaggr export --project <id> |
A project's configuration as JSON, to stdout or --output <file> |
flaggr sourcemaps upload <dir> --release <r> --url-prefix <path> |
Upload source maps, so the Issues page shows minified stack traces as your source (also sourcemaps list and sourcemaps delete) |
flaggr crash-reports [on|off|status] |
Send the CLI's crashes to the Flaggr team (off by default) |
Every command takes --json for JSON output. flaggr <command> --help lists a command's flags.
~/.flaggr/config.json holds the API URL, the token and the default project flaggr login saved. These environment variables override it:
| Variable | Default | What it sets |
|---|---|---|
FLAGGR_API_URL |
https://flaggr.dev |
The Flaggr API. For a self-hosted Flaggr, flaggr login --url https://flaggr.example.com saves it instead. |
FLAGGR_API_TOKEN |
The saved token | The token every command sends |
FLAGGR_EVAL_URL |
https://api.flaggr.dev with flaggr.dev, otherwise the API URL |
Where flaggr eval sends evaluations |
FLAGGR_CRASH_REPORTS |
The saved setting (off) | 1 or 0 turns crash reports on or off |
Upload the source maps of each release you deploy, under the release your app reports. Flaggr then shows the minified frames on the Issues page as the original file, line and source:
# Next.js: the maps of .next/static, served under /_next/static
flaggr sourcemaps upload .next/static --url-prefix /_next/static --release "$GIT_SHA" --project <id>Each map is filed under the path its minified file has in stack traces: --url-prefix plus the map's path in the directory, without .map. Run --dry-run to see those paths without uploading anything. Maps are gzipped before they're sent, and each must be under 64 MiB. A project keeps the maps of its last 20 releases. Your build must emit source maps; for Next.js that means productionBrowserSourceMaps: true. You don't have to serve them publicly.
Crash reports are off unless you turn them on with flaggr crash-reports on or FLAGGR_CRASH_REPORTS=1. DO_NOT_TRACK=1 and CI environments (CI set) always keep them off.
When they're on and the CLI crashes (a panic), a report goes to the Flaggr team at https://flaggr.dev/api/ingest/cli-crashes. The report contains:
- the panic's message and stack,
- the CLI's version,
- the subcommand that ran, such as
flags list, never its arguments or flags, - your OS, architecture and Go version.
It never contains your token, URLs, flag keys or command output. The endpoint takes no credential and stores reports only in Flaggr's own project. It removes tokens and email addresses from the message and stack.
Errors a command returns, such as a rejected token or a network failure, aren't crashes and are never reported. When reports are off, a crash prints how to report it instead.
make build # ./flaggr
make test # go test -race
make vuln # govulncheckinternal/flaggrv1 is generated from proto/: the messages and Connect-RPC clients of the parts of Flaggr's API the CLI calls (flags.proto; evaluation.proto, EvaluationService; streaming.proto, FlagStreamService). After changing a .proto file, regenerate it with buf:
buf generate # or: make generatebuf.gen.yaml pins the plugins (protoc-gen-go v1.36.11 and protoc-gen-connect-go v1.20.0), so unchanged sources generate the committed code. To use protoc instead, install those two plugins and run:
protoc -I proto \
--go_out=internal/flaggrv1 --go_opt=paths=source_relative \
--connect-go_out=internal/flaggrv1 --connect-go_opt=paths=source_relative \
proto/flags.proto proto/evaluation.proto proto/streaming.protoThe only difference from buf's output is the protoc version in each file's header.
THIRD_PARTY_NOTICES holds the licenses of Go and of the modules compiled into flaggr, and every release archive ships it. After changing dependencies, regenerate it with make notices (scripts/third-party-notices.sh): while it's out of date, CI fails and GoReleaser won't release.
Pushing a v* tag runs GoReleaser (.github/workflows/release.yml), which builds the archives and checksums.txt and publishes them as a GitHub release; it stamps the version and commit that flaggr --version prints. make snapshot (goreleaser release --snapshot --clean) builds the same archives in dist/ without publishing anything.
Please report vulnerabilities privately: see SECURITY.md.
MIT. The binaries also contain Go's standard library and other Go modules, under their own licenses: see THIRD_PARTY_NOTICES.