> AI agents: this is one page from PostHog's docs. Full index of Markdown docs for LLMs: https://posthog.com/llms.txt

# Payloads – Feature Flags pocket guide

Canonical URL: https://posthog.com/learn/feature-flags/pocket-guide/payloads

> **Cloud region:** This page uses US Cloud hosts. For an EU Cloud project, use `https://eu.posthog.com` instead of `https://app.posthog.com` (app host for links).

## On this page

- [Choose where a value lives](#choose-where-a-value-lives)
- [Keep a default in code](#keep-a-default-in-code)
- [Payloads are not secrets](#payloads-are-not-secrets)

Chapter 05

# Payloads – Feature Flags pocket guide

A feature flag can carry a [payload](https://posthog.com/docs/feature-flags/creating-feature-flags.md#payloads), which lets it decide how that feature behaves. A payload is any JSON value that PostHog sends with the flag's answer, so you can change copy, limits, or config from PostHog without a deploy.

## Choose where a value lives

A value can live in four places. Ask these questions in order, and stop at the first yes:

1.  **Is it a secret, or has it stopped changing?** Keep it in your code or config. A value that hasn't changed in six months belongs in the codebase.
2.  **Does everyone get it, with no flag gating a feature?** Use a remote config flag, like an announcement banner: one payload, no targeting.
3.  **Does it differ between variants?** Put it on a multivariate flag, with one payload per variant, like different copy or pricing for each.
4.  **Does it belong to a feature some people have?** Put it on the boolean flag that gates the feature, like the settings of the new checkout below.

## Keep a default in code

For `new-checkout`, the payload holds the settings of the new checkout:

```json
{
  "buttonLabel": "Pay now",
  "maxSavedCards": 5
}
```

Read the payload once, where you read the flag, and fall back to a value in code when it's missing:

```javascript
const checkoutConfig =
  posthog.getFeatureFlagPayload(NEW_CHECKOUT_FLAG) ??
  { buttonLabel: 'Continue', maxSavedCards: 3 }
```

If you bootstrap flags, bootstrap their payloads too, with `featureFlagPayloads`.

## Payloads are not secrets

Every payload a client SDK loads is visible to anyone who opens the browser's network tab, which is why the first question comes first. Remote config can encrypt a payload, but then only your server can read it, with a personal API key. Keep keys and credentials out of anything a client loads, and keep real secrets in your config, not in a flag.

Prompt for PostHog AI

```text
Add a JSON payload {"buttonLabel": "Pay now"} to <my flag key>.
```

[Ask PostHog AI](https://app.posthog.com/#panel=max:!Add%20a%20JSON%20payload%20%7B%22buttonLabel%22%3A%20%22Pay%20now%22%7D%20to%20%3Cmy%20flag%20key%3E.)Needs a feature flag in your project. Swap in its key first.

See also: [Payloads](https://posthog.com/docs/feature-flags/creating-feature-flags.md#payloads) · [Remote config](https://posthog.com/docs/feature-flags/remote-config.md) · [Flags vs configuration](https://posthog.com/product-engineers/feature-flags-vs-configuration.md)