[luismeyer]

Updates the Flags SDK docs and README so they no longer say a FLAGS_SECRET is required, matching the SDK changes in #586, #587 and #589.

Stacked on #589. Merge after #586 → #587 → #589, and ship it with the flags release that includes them.

Why

After #586, #587 and #589, an app on Vercel works without a FLAGS_SECRET. encryptFlagValues uses the public key of Vercel, the SDK accepts overrides that Vercel signs, and the discovery endpoint accepts tokens that Vercel signs. The docs still tell every project to generate and set a secret, and the SvelteKit examples import FLAGS_SECRET from $env/static/private. That import fails the build when the variable isn't defined.

Approach

Describe FLAGS_SECRET as optional on Vercel, and keep it documented where it's still needed:

• precompute
• Flags Explorer outside Vercel, or locally without vercel env pull
• creating your own encrypted overrides, such as in e2e tests

Projects that already have a secret keep working.

Changes

• packages/flags/README.md (the root README.md links to it): Setup now leads with the no-secret path, and FLAGS_SECRET gets its own optional section.
• providers/vercel.mdx: drops the line saying activation creates a FLAGS_SECRET that overrides depend on, and drops FLAGS_SECRET from the copy prompt.
• frameworks/sveltekit/index.mdx: the setup step is now just vc env pull, and createHandle({ flags }) no longer passes a secret.
• api-reference/frameworks/sveltekit.mdx: createHandle's secret is optional, with the no-secret behavior described.
• api-reference/frameworks/next.mdx: createFlagsDiscoveryEndpoint works without a secret on Vercel.
• api-reference/core/core.mdx: verifyAccess accepts Vercel-signed tokens, returns false without a secret, and has a secret param. decryptOverrides can't read Vercel-signed overrides.
• frameworks/next/precompute.mdx and both e2e-tests.mdx guides: say the secret is still needed there.

Open points for review

• Does activating Vercel Flags still create a FLAGS_SECRET per environment? This PR stops saying it does, but doesn't claim it no longer happens.
• The minimum flags version isn't stated. Add it once the release version is known.
• Out of scope: skills/flags-sdk, skills/vercel-flags, and the examples/providers/* READMEs and deploy buttons still treat FLAGS_SECRET as required.

Validation

These are docs-only changes, checked against the behavior in the #586, #587 and #589 PR descriptions and against packages/flags/src/sveltekit/{index,env}.ts on the #589 branch. I did not build the docs site.

Co-authored-by: vercel-v[bot] <353008837+vercel-v[bot]@users.noreply.github.com>

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
flags-playground	Ready	Preview, v0	Nov 10, 2026 4:20pm UTC
flags-sdk-dev	Ready	Preview, v0	Nov 10, 2026 4:20pm UTC
flags-sdk-snippets	Ready	Preview, v0	Nov 10, 2026 4:20pm UTC
flags-sdk-sveltekit-snippets	Ready	Preview, v0	Nov 10, 2026 4:20pm UTC
shirt-shop	Ready	Preview, v0	Nov 10, 2026 4:20pm UTC
shirt-shop-api	Ready	Preview, v0	Nov 10, 2026 4:20pm UTC