Frontend frameworks

Connect browser applications through your own backend without exposing a SwitchPilot credential.

Server-side essentials
Security and runtime requirements for every integration.

Official SDKs are server-side only.

Never expose API keys in browser or client code.

Store API keys in environment variables.

The default fallback is false.

SDKs fail safely if SwitchPilot is unreachable.

Default cache TTL: 60 seconds.

Default stale-if-error window: 5 minutes.

Secure architecture

request flow
Angular / Vue / React / Svelte browser
→ GET /api/features on your own backend
→ Node.js or Python server
→ SwitchPilot SDK

The browser calls a route owned by your application. That route applies your normal authentication and authorization, evaluates the flag with the server-side SDK, and returns only the safe values the UI needs.

1. Install on the backend

Node.js backend
pnpm add @switchpilot/node
Python backend
pip install switchpilot
server .env
SWITCHPILOT_API_KEY="sp_live_your_project_key"

2. Evaluate on the server

backend/features.ts
import { createSwitchPilot } from "@switchpilot/node";

const flags = createSwitchPilot({
  apiKey: process.env.SWITCHPILOT_API_KEY!,
});

// Use this inside your authenticated backend route.
const newCheckout = await flags.isEnabled("new-checkout");
return { newCheckout };

isEnabled() reads the local in-memory cache. A configuration change may take up to the 60-second cache TTL to appear unlessrefresh() is called manually. Read the Reliability guide.

3. Read safe values in Angular, Vue, React, or Svelte

browser feature service
const response = await fetch("/api/features");
const features = await response.json();

if (features.newCheckout) {
  // Render the enabled experience.
}

This browser code contains no SwitchPilot package, endpoint, or secret. Framework-specific state management can wrap the same request pattern.