The Feature Flags Behind app.onepassapps.com: 43 Product Switches, 9 Live Apps

I work on OnePassApps, so this is our own product and everything below is a measurement of our own build, taken today from outside the browser with no session and no cookies.

On 4 November 2026 at about 20:33 UTC I fetched four JSON endpoints from the API host behind app.onepassapps.com and read them as bytes. This post is about the one I had not looked at before: the feature-flag configuration the app reads at runtime.

The route

GET https://api.onepassapps.com/api/config/feature-flags answers HTTP 200 with a content-type of application/json and a body of exactly 1,771 bytes. Like every other route on this host it carries Cache-Control: private, no-store, max-age=0.

The payload carries three things: a revision of 0a59d8fd00f640d57d3fd34b, a refreshAfterMs of 15000, and a values object with 46 keys.

43 product flags, all on

43 of the 46 keys are named product.<name>.enabled, and every one of them is true. The other three are not product switches:

• release.public-signup.enabled - true
• sam.chat.enabled - true
• sam.chat.max-input-characters - 4000

The product names are internal, kebab-case identifiers: ambient-noise-mixer, budget-meal-planner, calendar-maker, chart-maker, citation-formatter, contractdesk, cutroom, cv-builder, docdeck, email-signature, focus-timer, freelancercash, habitpacer, homevault, intakedesk, invoice-maker, label-maker, localpass, meetingmemo, mindmaps, movie-tracker, orderdesk, pageping, paperkit, password-generator, pixelkit, qr-code-maker, receiptless, runway, screen-planner, screen-recorder, sessionshelf, signaldesk, signature-maker, slotdesk, snippetbox, social-card, studydesk, subtitle-workbench, subtracker, teleprompter, time-zone-planner, word-counter.

The gap between the flags and the front door

The home page lists nine apps: two hosted ones and seven browser studios. One of the 43 flag names matches a public route segment - movie-tracker, which is the MovieMatcherAI URL. None of the other 42 names appears in any page I fetched (the home page, guides, the vote board, both hosted apps, all seven studios and the plans page), and the seven studio names (image, audio, files, text, data, icons, colour) are not among them either.

Two of the unlisted names do line up with something the site says about itself. The home page meta description promises to "build a résumé" and to "chart CSV data", and two enabled flags are named cv-builder and chart-maker - but neither has a card on the page. The third promise in that same sentence, organising PDFs, has no matching flag name in the 43.

So 43 flags are on while the front door shows nine apps. I am not going to guess what that gap means. A flag being on is not the same thing as a public route, and nothing I read today establishes which of the 43 a visitor can reach. What is measurable is that the two counts are 43 and 9, and that only one flag name matches a public URL segment.

Two neighbours on the same host

GET /api/runtime (471 bytes) reports maintenance.enabled false, announcement.enabled false with an empty message, publicSignupEnabled true, and two products whose mode is inherit with an empty message: signaldesk and movie-tracker. It also stamps a generatedAt time.

GET /api/auth/config (371 bytes) reports publicSignupEnabled true, checkoutOpen false, a controller named OnePassApps with a null address, a support contact of [email protected], and five retention windows: 35 days for account backups, 90 for usage-cost telemetry, 30 for rate-limit events, 48 hours for shared metadata in SignalDesk, and 30 minutes for generated audio.

The flag endpoint tells clients to refresh every 15 seconds, so the flag set can change between two loads of the same page.

Limits

One build, one snapshot (4 Nov 2026, about 20:33 UTC), one network, signed out - no session, no cookies, no JavaScript. The flags can change every 15 seconds, so read the counts as a moment rather than a promise. I did not test what any flag changes for a signed-in user, and I did not map internal names onto public routes beyond what the pages themselves print. The raw JSON is saved as an artifact; nothing here is a guess about why the two numbers differ.

If you want to read the app itself: app.onepassapps.com and the guides.

I work on OnePassApps, the team behind app.onepassapps.com.