fix(flags): load definitions from a cache provider without a secret key

[frankh]

💡 Motivation and Context

• A client with a flag_definition_cache_provider and no secret_key never evaluates flags locally. Every flag call makes a remote /flags request.
• load_feature_flags() returns early when no key is set, before it calls the cache provider. It also sets feature_flags = [].
• The lazy load on the first flag call has the same check, so it never loads either.
• A cache provider exists so that a process can read definitions from a shared cache without polling the API, so it does not need a key. _load_feature_flags() already handles this case: it reads the provider first, and needs the key only for an API fetch.
• The PostHog app runs into this on self-hosted and preview instances. There the server reads its own flags from a cache provider with no key, so every server-side flag check becomes a network request.

💚 How did you test it?

• load_feature_flags() and the two lazy-load checks now accept either a key or a cache provider. With neither, the client logs the same warning as before.
• New parameterized test in TestCacheInitialization: a client with a provider and no key loads the cached definitions through load_feature_flags(), and through the lazy load on the first get_feature_flag() call. Both cases fail without the fix. The existing provider tests call the private _load_feature_flags() directly, so they never reached this check.
• Not checked: the change inside the PostHog app. It needs a release of posthoganalytics.

📝 Checklist

• I reviewed the submitted code.
• I added tests to verify the changes.
• I updated the docs if needed.
• No breaking change or entry added to the changelog.

If releasing new changes

• Ran sampo add to generate a changeset file

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

• Written with Claude Code, Claude Opus 5.5 (claude-opus-5-5).
• Found while timing slow HogQL queries on a PostHog preview: each query made an uncached flag check that went to /flags, because the web process had no local definitions.
• The changeset was written by hand in .sampo/changesets/, in the same format as sampo add.

---

Created with PostHog Desktop

[github-actions]

posthog-python Compliance Report

Date: 2026-10-08T13:17:43.753283+00:00
Duration: 260034ms

✅ All Tests Passed!

121/121 tests passed

---

Capture_V1 Tests

✅ 95/95 tests passed

View Details

Test	Status	Duration
Endpoint And Method.Targets V1 Endpoint	✅	521ms
Endpoint And Method.Does Not Use Legacy Endpoints	✅	512ms
Required Headers.Has Authorization Bearer Header	✅	511ms
Required Headers.Has Content Type Json	✅	513ms
Required Headers.Has Posthog Sdk Info Format	✅	510ms
Required Headers.Has Posthog Attempt Header	✅	512ms
Required Headers.Has Posthog Request Id	✅	511ms
Required Headers.Has Posthog Request Timestamp	✅	510ms
Required Headers.Has User Agent	✅	512ms
Body Format.Body Has Created At And Batch	✅	511ms
Body Format.No Api Key In Body	✅	511ms
Body Format.No Sent At In Body	✅	512ms
Event Format.Event Has Required Root Fields	✅	512ms
Event Format.Event Uuid Is Valid	✅	511ms
Event Format.Event Timestamp Is Rfc3339	✅	511ms
Event Format.Non Utc Event Timestamp Is Converted To Utc	✅	518ms
Event Format.Distinct Id Is String	✅	512ms
Event Format.Distinct Id At Root Not Properties	✅	511ms
Event Format.Custom Properties Preserved	✅	511ms
Event Format.Set Properties Preserved	✅	511ms
Event Format.Set Once Properties Preserved	✅	511ms
Event Format.Groups Properties Preserved	✅	511ms
Event Format.Sdk Generates Uuid If Not Provided	✅	511ms
Event Format.Event Has Required Root Fields Batch	✅	513ms
Event Format.Event Uuid Is Valid Batch	✅	516ms
Event Format.Event Timestamp Is Rfc3339 Batch	✅	514ms
Event Format.Distinct Id Is String Batch	✅	516ms
Event Format.Distinct Id At Root Not Properties Batch	✅	514ms
Event Format.Custom Properties Preserved Batch	✅	517ms
Event Format.Set Properties Preserved Batch	✅	514ms
Event Format.Set Once Properties Preserved Batch	✅	517ms
Event Format.Groups Properties Preserved Batch	✅	515ms
Event Format.Sdk Generates Uuid If Not Provided Batch	✅	516ms
Batch Behavior.Multiple Events In Single Batch	✅	518ms
Batch Behavior.Batch Envelope Smoke	✅	517ms
Batch Behavior.Flush With No Events Sends Nothing	✅	507ms
Batch Behavior.Flush At Triggers Batch	✅	1012ms
Batch Behavior.Created At Reflects Batch Creation Time	✅	513ms
Deduplication.Generates Unique Uuids	✅	518ms
Deduplication.Different Events Same Content Different Uuids	✅	515ms
Deduplication.Preserves Uuid On Retry	✅	6520ms
Deduplication.Preserves Timestamp On Retry	✅	6522ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry	✅	6527ms
Deduplication.No Duplicate Events In Batch	✅	522ms
Header Behavior On Retry.Attempt Header Starts At One	✅	510ms
Header Behavior On Retry.Attempt Header Increments On Retry	✅	13525ms
Header Behavior On Retry.Request Id Preserved On Retry	✅	6522ms
Header Behavior On Retry.Different Requests Have Different Request Ids	✅	3020ms
Header Behavior On Retry.Request Timestamp Changes On Retry	✅	6524ms
Response Format Validation.Success Response Has Uuid Keyed Results	✅	511ms
Response Format Validation.Success Response Has Ok For Each Event	✅	517ms
Response Format Validation.Success No Retry After When All Ok	✅	514ms
Response Format Validation.Success Retry After Present When Retry Events	✅	1518ms
Response Format Validation.Success No Retry After When Drop Only	✅	515ms
Response Format Validation.Response Echoes Request Id	✅	511ms
Retry Behavior.Retries On 408	✅	6521ms
Retry Behavior.Retries On 500	✅	6522ms
Retry Behavior.Retries On 503	✅	8524ms
Retry Behavior.Retries On 504	✅	6521ms
Retry Behavior.Retryable Errors Have Retry After	✅	3516ms
Retry Behavior.Respects Retry After On Retryable Error	✅	11524ms
Retry Behavior.Does Not Retry On 400	✅	2514ms
Retry Behavior.Does Not Retry On 401	✅	2514ms
Retry Behavior.Does Not Retry On 402	✅	2512ms
Retry Behavior.Does Not Retry On 413	✅	2515ms
Retry Behavior.Does Not Retry On 415	✅	2514ms
Retry Behavior.Non Retryable Errors Have No Retry After	✅	2514ms
Retry Behavior.Implements Backoff	✅	22528ms
Retry Behavior.Max Retries Respected	✅	22529ms
Partial Batch Handling.Handles 200 Full Success	✅	2513ms
Partial Batch Handling.Handles 200 With All Ok	✅	3518ms
Partial Batch Handling.Does Not Retry Dropped Events	✅	3518ms
Partial Batch Handling.Does Not Retry Limited Events	✅	3515ms
Partial Batch Handling.Prunes Ok Events On Partial Retry	✅	6523ms
Partial Batch Handling.Prunes Dropped Events On Partial Retry	✅	6523ms
Partial Batch Handling.Retries Only Retry Events From Partial	✅	6525ms
Partial Batch Handling.Partial Retry Preserves Uuids	✅	6522ms
Partial Batch Handling.Partial Retry Attempt Header Increments	✅	6518ms
Partial Batch Handling.Partial Retry Request Id Preserved	✅	6519ms
Partial Batch Handling.Respects Retry After On Partial	✅	8522ms
Partial Batch Handling.Unknown Result Treated As Terminal	✅	3518ms
Partial Batch Handling.Mixed Ok Drop Limited No Retry	✅	3520ms
Compression.Sends Gzip Content Encoding	✅	511ms
Compression.No Content Encoding When Disabled	✅	510ms
Compression.Compressed Body Is Decompressible	✅	511ms
Error Handling.Does Not Retry On Unknown 4Xx	✅	2515ms
Event Options.Cookieless Mode Override	✅	511ms
Event Options.Disable Skew Correction Override	✅	510ms
Event Options.Process Person Profile Override	✅	510ms
Event Options.Product Tour Id Override	✅	511ms
Event Options.Unset Options Omitted	✅	511ms
Event Options.Options Override In Batch	✅	514ms
Geoip And Historical Migration.Geoip Disable Injected Into Properties	✅	510ms
Geoip And Historical Migration.Historical Migration Set In Body	✅	511ms
Geoip And Historical Migration.Historical Migration Absent By Default	✅	510ms

Capture_Ai Tests

✅ 5/5 tests passed

View Details

Test	Status	Duration
Routing.Capture Ai Posts To Ai Endpoint	✅	511ms
Routing.Capture Does Not Reroute Ai Named Events	✅	511ms
Identity.Capture Ai Event Has Uuid	✅	510ms
Identity.Capture Ai Keeps Supplied Uuid	✅	511ms
Timestamp Format.Non Utc Event Timestamp Is Converted To Utc	✅	510ms

Feature_Flags Tests

✅ 17/17 tests passed

View Details

Test	Status	Duration
Request Payload.Request With Person Properties Device Id	✅	12ms
Request Payload.Flags Request Uses V2 Query Param	✅	10ms
Request Payload.Flags Request Hits Flags Path Not Decide	✅	11ms
Request Payload.Flags Request Omits Authorization Header	✅	10ms
Request Payload.Token In Flags Body Matches Init	✅	11ms
Request Payload.Groups Round Trip	✅	10ms
Request Payload.Groups Default To Empty Object	✅	11ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False	✅	11ms
Request Payload.Disable Geoip Omitted Defaults To False	✅	10ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key	✅	9ms
Request Lifecycle.No Flags Request On Init Alone	✅	4ms
Request Lifecycle.No Flags Request On Normal Capture	✅	509ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests	✅	15ms
Request Lifecycle.Mock Response Value Is Returned To Caller	✅	9ms
Retry Behavior.Retries Flags On 502	✅	314ms
Retry Behavior.Retries Flags On 504	✅	314ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event	✅	512ms

Feature_Flags_Local_Evaluation Tests

✅ 4/4 tests passed

View Details

Test	Status	Duration
Versioned Boolean Matching.Matching Version Missing	✅	73ms
Versioned Boolean Matching.Matching Version 1	✅	70ms
Versioned Boolean Matching.Matching Version 2	✅	70ms
Versioned Boolean Matching.Version Only Reload 1 2 1 2 Missing	✅	37ms

[dustinbyrne]

The provider-only loader fix and patch changeset look sound. One non-blocking documentation suggestion below.

AI-assisted review.

[dustinbyrne]

[P2] Configuration docs omit provider-only polling eligibility

The constructor and module configuration docs (posthog/client.py:793–796 and posthog/__init__.py:365–368) describe enable_local_evaluation polling when a personal API key is configured. This patch also permits loading with a provider alone and, by default, starts background refresh after loading (client.py:3482–3486,3515–3525).

The existing description is incomplete rather than wholly false. Provider-only clients previously returned before poller creation; the changed eligibility check makes this lifecycle distinction relevant.

Consider documenting that either privileged configuration or a cache provider permits definition loading, that provider refreshes consult its fetch decision, and that enable_local_evaluation=False suppresses background polling without preventing explicit or first-use hydration.

Verification is a static comparison of these descriptions against the eligibility predicate and poller-start condition. This documentation-only recommendation does not require an automated behavioral regression.

[dustinbyrne]

one follow-up came up as we ported this to other SDKs.

keyless readers should read the cache directly without invoking the fetch-decision callback, since it can acquire fetch leadership for a worker that cannot fetch.

should_fetch = self.personal_api_key is not None
if self._flag_definition_cache_provider and should_fetch: