Reference
Limits, response codes, reason values and what feature flags do not do yet
Copy this guide and your current settings as a prompt for your AI agent.
Preview agent promptSee the guide, code and settings included when you copy.
01Limits
| Item | Limit |
|---|---|
| Flag key | 1–128 characters, ^[a-z][a-z0-9_-]*$, unique per project, fixed after creation |
| Condition sets per flag | 20 |
| Variants per flag | 2–100, split must total exactly 100 % |
| Payload (flag or variant) | 32 KB of JSON |
| Selector groups per flag | 20; names are lowercase letters, digits, _ and - |
| Request body | 64 KB; up to 100 names and 100 groups per selector |
userToken |
512 characters |
currentUrl |
Absolute URL, 4,096 characters |
userContext |
4 KB of JSON |
| Rollout precision | Two decimals (0.01 %), 100,000 buckets |
| Browser timeout and cache | 3 s request timeout; 5 minute localStorage cache after consent |
02Reasons
reason |
enabled |
When |
|---|---|---|
inactive |
false |
The flag is switched off in the dashboard |
remote_config |
true |
Active remote config; payload returned, no condition consulted, no token needed |
condition_match |
true |
A condition set matched and the visitor fell inside its rollout. Variant flags also return variant |
no_matching_condition |
false |
No condition set passed |
missing_user_token |
false |
Properties matched but the rollout or split needs a token and none was sent. Also sets errorsWhileComputingFlags |
03Responses
| Response | Meaning |
|---|---|
404 Project Feature Flags not found |
The project has never published a flag |
401 Unauthorized |
Server key missing from the Edge, revoked or wrong. A bad key never falls back to public flags |
403 Project does not match Server API key |
The key belongs to another project |
405 |
Anything but POST |
413 |
Body over 64 KB or userContext over 4 KB |
A key missing from flags |
The flag was deleted, is private and the request had no key, or is not in the selector |
04Freshness and caching
The Edge reads the project snapshot from its store on every request with no
cache in the worker, so a publish is visible on the next request. Responses
are Cache-Control: private, no-store. The browser SDK keeps its own
5 minute cache per project after consent.
05What flags do not do yet
- No reporting. Flags do not send exposure events and do not appear in experiment results. Use a Coframe experiment when you need measured impact.
- No history or rollback. Each save raises a version number, but earlier versions cannot be viewed or restored. Deleting a flag is permanent.
- npm only. Flags are not available through the
cf.jsscript tag orwindow.Coframe. - No local evaluation. The server SDK always calls the Edge.
- Dashboard operators are equals, contains and not contains; nested and/or rules are API-only and shown read-only.
# Reference Limits, response codes, reason values and what feature flags do not do yet ## Limits Item | Limit | Flag key | 1–128 characters, `^[a-z][a-z0-9_-]*$`, unique per project, fixed after creation | Condition sets per flag | 20 | Variants per flag | 2–100, split must total exactly 100 % | Payload (flag or variant) | 32 KB of JSON | Selector groups per flag | 20; names are lowercase letters, digits, `_` and `-` | Request body | 64 KB; up to 100 names and 100 groups per selector | `userToken` | 512 characters | `currentUrl` | Absolute URL, 4,096 characters | `userContext` | 4 KB of JSON | Rollout precision | Two decimals (0.01 %), 100,000 buckets | Browser timeout and cache | 3 s request timeout; 5 minute `localStorage` cache after consent | ## Reasons `reason` | `enabled` | When | `inactive` | `false` | The flag is switched off in the dashboard | `remote_config` | `true` | Active remote config; payload returned, no condition consulted, no token needed | `condition_match` | `true` | A condition set matched and the visitor fell inside its rollout. Variant flags also return `variant` | `no_matching_condition` | `false` | No condition set passed | `missing_user_token` | `false` | Properties matched but the rollout or split needs a token and none was sent. Also sets `errorsWhileComputingFlags` | ## Responses Response | Meaning | `404 Project Feature Flags not found` | The project has never published a flag | `401 Unauthorized` | Server key missing from the Edge, revoked or wrong. A bad key never falls back to public flags | `403 Project does not match Server API key` | The key belongs to another project | `405` | Anything but `POST` | `413` | Body over 64 KB or `userContext` over 4 KB | A key missing from `flags` | The flag was deleted, is private and the request had no key, or is not in the selector | ## Freshness and caching The Edge reads the project snapshot from its store on every request with no cache in the worker, so a publish is visible on the next request. Responses are `Cache-Control: private, no-store`. The browser SDK keeps its own 5 minute cache per project after consent. ## What flags do not do yet - No reporting. Flags do not send exposure events and do not appear in experiment results. Use a Coframe experiment when you need measured impact. - No history or rollback. Each save raises a version number, but earlier versions cannot be viewed or restored. Deleting a flag is permanent. - npm only. Flags are not available through the `cf.js` script tag or `window.Coframe`. - No local evaluation. The server SDK always calls the Edge. - Dashboard operators are equals, contains and not contains; nested and/or rules are API-only and shown read-only.
BACK TOFeature Flags