[luismeyer]

Updates the Flags SDK docs and README so they no longer say a FLAGS_SECRET is required, matching the SDK changes in #586, #587, #589 and #597.

Stacked on #597. Merge after #586 → #587 → #589 → #597, and ship it with the flags release that includes them.

Why

After #586, #587 and #589, an app on Vercel works without a FLAGS_SECRET. encryptFlagValues uses the public key of Vercel, the SDK accepts overrides that Vercel signs, and the discovery endpoint accepts tokens that Vercel signs. After #597, precompute signs its codes with a key that Vercel provides for each deployment. The docs still tell every project to generate and set a secret, and the SvelteKit examples import FLAGS_SECRET from $env/static/private. That import fails the build when the variable isn't defined.

Approach

Describe FLAGS_SECRET as optional on Vercel, and keep it documented where it's still needed:

• precompute in local development, outside Vercel, with vercel build, or when a code must be valid in another deployment
• Flags Explorer outside Vercel, or locally without vercel env pull
• creating your own encrypted overrides, such as in e2e tests

Projects that already have a secret keep working.

Changes

• packages/flags/README.md (the root README.md links to it): Setup now leads with the no-secret path, and FLAGS_SECRET gets its own optional section.
• providers/vercel.mdx: drops the line saying activation creates a FLAGS_SECRET that overrides depend on, and drops FLAGS_SECRET from the copy prompt.
• frameworks/sveltekit/index.mdx: the setup step is now just vc env pull, and createHandle({ flags }) no longer passes a secret.
• api-reference/frameworks/sveltekit.mdx: createHandle's secret is optional, with the no-secret behavior described.
• api-reference/frameworks/next.mdx: createFlagsDiscoveryEndpoint works without a secret on Vercel.
• api-reference/core/core.mdx: verifyAccess accepts Vercel-signed tokens, returns false without a secret, and has a secret param. decryptOverrides verifies Vercel-signed overrides without a secret. The project must expose the system environment variables.
• frameworks/next/precompute.mdx: precompute works on Vercel without a secret, with the cases that still need one. The precomputation sections of the Next.js and SvelteKit API references have the same note.
• Both e2e-tests.mdx guides: say the secret is still needed there.

Open points for review

• Does activating Vercel Flags still create a FLAGS_SECRET per environment? This PR stops saying it does, but doesn't claim it no longer happens.
• The minimum flags version isn't stated. Add it once the release version is known.
• Out of scope: skills/flags-sdk, skills/vercel-flags, and the examples/providers/* READMEs and deploy buttons still treat FLAGS_SECRET as required.

Validation

These are docs-only changes, checked against the behavior in the #586, #587, #589 and #597 PR descriptions and changesets, and against packages/flags/src/sveltekit/{index,env}.ts and packages/flags/src/lib/precompute-secret.ts on the #597 branch. I did not build the docs site.

Co-authored-by: vercel-v[bot] <353008837+vercel-v[bot]@users.noreply.github.com>

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
flags-playground	Ready	Preview, v0	Nov 11, 2026 2:57pm UTC
flags-sdk-dev	Ready	Preview, v0	Nov 11, 2026 2:57pm UTC
flags-sdk-flagsmith	Ready	Preview, v0	Nov 11, 2026 2:57pm UTC
flags-sdk-growthbook	Ready	Preview, v0	Nov 11, 2026 2:57pm UTC
flags-sdk-launchdarkly	Ready	Preview, v0	Nov 11, 2026 2:57pm UTC
flags-sdk-openfeature	Ready	Preview, v0	Nov 11, 2026 2:57pm UTC
flags-sdk-posthog	Ready	Preview, v0	Nov 11, 2026 2:57pm UTC
flags-sdk-reflag	Ready	Preview, v0	Nov 11, 2026 2:57pm UTC
flags-sdk-snippets	Ready	Preview, v0	Nov 11, 2026 2:57pm UTC
flags-sdk-statsig	Ready	Preview, v0	Nov 11, 2026 2:57pm UTC
flags-sdk-sveltekit-snippets	Ready	Preview, v0	Nov 11, 2026 2:57pm UTC
shirt-shop	Ready	Preview, v0	Nov 11, 2026 2:57pm UTC
shirt-shop-api	Ready	Preview, v0	Nov 11, 2026 2:57pm UTC