Shipkit
BlogChangelogDocs
Back to Changelog
May 7, 20263 commits

Preview Feature Flag Overrides via Query Params

Enable or disable feature flags at runtime using URL query parameters — no redeploy needed.

Feature Flag Query-Param Overrides

You can now toggle any feature flag at runtime without redeploying by hitting the new /api/flags route.

Usage

/api/flags?feature_flag_database=1&feature_flag_mdx=0

Overrides are stored in a short-lived cookie (_shipkit_preview, 8 hours) and merged with your existing flags on every request.

Parameters

ParamEffect
feature_flag_<name>=1Enable the named flag
feature_flag_<name>=0Disable the named flag
clear=1Remove all overrides
redirect=<path>Redirect to <path> after applying (internal paths only)
token=<secret>Required when PREVIEW_SECRET is set in env

Security

  • When PREVIEW_SECRET is set, a matching token query param is required — unauthenticated requests return 401.
  • Cookie flag names are validated against the allowlist of known featureFlagNames; unknown keys are silently dropped.
  • Redirect targets must be same-origin paths; external URLs are rewritten to /.
  • Cookie payload is capped at 2 KB to prevent overflow abuse.