Vercel Flags can now read another project's flags without an SDK key

Vercel shipped Project Connections for Flags on 2 November, letting one project evaluate flags defined in a different project on the same team without copying a server SDK key between them. Previously, sharing a flag across a marketing site and a main app meant pasting that key into an environment variable and managing it by hand.

A connected deployment now authenticates with its own identity instead: run vercel env pull locally to pick up the project’s OIDC token, or manage connections from the Connections page under a project’s Flags tab, or with vercel flags connections in the CLI. Connections are read-only, and the consuming deployment’s environment decides which flag environment it reads, so a production deployment gets production flags. Access can be revoked instantly with no redeploy needed. It needs @flags-sdk/vercel 1.6.0 or later (or @vercel/flags-core 1.11.0 if you use the core library directly), and CLI 63.0.0 or later to manage connections. It’s available on every plan.

import { createVercelAdapter, sharedFlagsAdapter } from '@flags-sdk/vercel';

const source = createVercelAdapter({ projectId: 'prj_source' });

export const showBanner = flag<boolean>({
  key: 'show-banner',
  adapter: sharedFlagsAdapter(source),
});

Why it matters: if you run a monorepo-style setup with several Vercel projects, this removes a real source of secret sprawl, a server SDK key sitting in more environment variables than it needs to.