GitLab
GitLab feature flags: what you get, the limits, and when to outgrow them
GitLab has real feature flags, they are free, and they are built on Unleash. This is the honest reference: how to set them up correctly, exactly where the documented ceilings are (50 flags on Free, roughly 500 polling clients, no custom-attribute targeting), and the point where a dedicated platform starts to earn its keep.
The short answer
GitLab feature flags are a built-in flag service available on Free, Premium and Ultimate, found under Deploy > Feature flags in any project. They are based on Unleash: GitLab runs its own Unleash-compatible backend, so you talk to it with standard Unleash SDKs configured with an API URL, an Instance ID and an Application name. The documented limits are the whole story: 50 flags per project on Free (150 Premium, 200 Ultimate), roughly 500 polling clients (about 8 RPS) before GitLab tells you to run the Unleash Proxy, five targeting strategies with no custom-attribute or segment rules, and no experiment analytics in the docs. For percentage rollouts inside a repo you already own, that is genuinely enough. For attribute targeting, experiments or a large fleet of clients, it is not.
Last updated July 2026 · verified against docs.gitlab.com
01 · Set them up
Four steps, and one gotcha that eats an afternoon
- 01 Create the flag. In the project, go to Deploy > Feature flags and select New feature flag. Give it a name your code will use verbatim, for example
checkout.new-flow. - 02 Pick a strategy. All users, Percent rollout (with a stickiness of user ID, session ID, random or available ID), Percent of users, User IDs, or a reusable User List. That is the full documented menu.
- 03 Set the environment spec. Each strategy applies to an environment: all environments, or a specific one such as
production. Remember which name you typed. - 04 Wire an Unleash SDK. Open Configure to copy the API URL and Instance ID, then point any Unleash client at them.
appName, and GitLab calls "Application name", is not your application's name. It has to match the environment on the flag's strategy. Put your service name there and every flag quietly evaluates to false.
// npm install unleash-client
const { initialize } = require('unleash-client');
// All three values come from Deploy > Feature flags > Configure
const unleash = initialize({
// Project-scoped Unleash API. The SDK appends /client/features itself.
url: 'https://gitlab.com/api/v4/feature_flags/unleash/42',
// GitLab calls this the "Instance ID". It is the auth token.
instanceId: process.env.GITLAB_UNLEASH_INSTANCE_ID,
// GOTCHA: "Application name" is NOT your app name.
// It must match the ENVIRONMENT spec on the flag: production, staging...
appName: process.env.GITLAB_ENVIRONMENT ?? 'production',
refreshInterval: 15000, // ms. Lower = more load on GitLab's API.
});
unleash.on('ready', () => {
// Percent of users and user-ID strategies REQUIRE a user id.
// Without it, the flag evaluates false for that visitor.
const on = unleash.isEnabled('checkout.new-flow', {
userId: String(currentUser.id),
});
render(on ? newCheckout() : legacyCheckout());
});
// Fail closed, not loudly: keep the old path if GitLab is unreachable.
unleash.on('error', (err) => log.warn('unleash', err));
Same shape in Ruby, Go, Python or Java: GitLab supports whatever Unleash clients exist, because the server side speaks the Unleash client API. If you are doing this in JavaScript, our Node.js feature flags guide covers the same call-site pattern against Toggled.
02 · The spec sheet
Everything GitLab documents, in one table
These are the documented numbers, not estimates. If a row says "none documented", it means GitLab's feature flag documentation describes no such capability, which is not the same as GitLab promising never to build it.
| Dimension | What GitLab documents |
|---|---|
| Availability | Free, Premium and Ultimate. GitLab.com, self-managed and Dedicated. |
| Where it lives | Project > Deploy > Feature flags. Developer role or above. |
| Technical basis | Based on Unleash. GitLab runs its own Unleash-compatible backend, so you use Unleash SDKs. |
| Flags per project (Free) | 50 on GitLab.com |
| Flags per project (Premium) | 150 |
| Flags per project (Ultimate) | 200 |
| Flags per project (self-managed) | 200 by default, configurable via the project_feature_flags application limit |
| Client throughput | Roughly 500 clients polling once per minute (about 8 RPS). Around 125 clients at one poll every 15 seconds. |
| Past that ceiling | Run the Unleash Proxy (v0.2 or later). Each proxy instance serves one environment, set by UNLEASH_APP_NAME. |
| Targeting strategies | All users; Percent rollout (stickiness: user ID, session ID, random, available ID); Percent of users; User IDs; User List. |
| Custom attributes, constraints, segments | None documented. No rules on plan, country, org or custom context fields. |
| Anonymous traffic | Percent-of-users and user-ID strategies require a user ID from the client, so anonymous visitors cannot be targeted that way. |
| Experiment analytics | None documented. No flag-level metrics, guardrails or statistical results in the feature flag docs. |
| Audit events | feature_flag_created, feature_flag_updated, feature_flag_deleted (since GitLab 15.10). Audit event reporting is Premium and Ultimate. |
| REST API | Full project-scoped CRUD: GET/POST /projects/:id/feature_flags and GET/PUT/DELETE /projects/:id/feature_flags/:name. On Free since 13.5. Separate API for user lists. |
| Price | Included. No extra vendor, no extra invoice. |
One clarification, because it confuses people right now: Unleash deprecated its own open source editions in favor of Enterprise, with LTS from December 10, 2025 and end-of-life on December 31, 2026. That matters if you self-host Unleash OSS yourself. It does not remove or deprecate GitLab's feature flags, because GitLab runs its own backend rather than the Unleash server. GitLab's flags ship on all tiers in GitLab 19.x today.
03 · The walls
Four walls you hit, and one that hits you first
None of these are secrets. They are in the documentation. They just tend to arrive in a specific order, months apart, and the fifth one arrives on a Tuesday when you upgrade an SDK.
Wall 1
The 50-flag cap on Free
Fifty flags per project sounds generous until you count. Long-lived ops toggles, config switches, permission gates and half-cleaned-up release flags all consume the budget, and the cap is per project, so a monorepo eats it fastest. Your options are disciplined cleanup, splitting projects, or paying up to Premium (150) or Ultimate (200) for a limit that is still a limit.
Wall 2
No custom-attribute targeting
GitLab documents five strategies, and none of them look at context. There is no documented way to say plan = enterprise, country = DE, or org_id in [...]. You get everyone, a percentage, or a list of user IDs. The workaround is to precompute cohorts in your app and maintain a User List, which means your targeting logic lives in two places and drifts.
Wall 3
No experiment analytics
You can send 50% of users down a new path. Nothing in the feature flag docs tells you whether that path converted better. There are no flag-level metrics, no guardrail alerts and no significance testing, so an A/B test means gluing the flag to a separate analytics tool, defining the exposure event yourself, and doing the statistics somewhere else. (GitLab has an internal experiment framework, but it is for building GitLab, not a feature you get.)
Wall 4
The polling ceiling and the proxy
The API supports roughly 500 clients polling once a minute, about 8 RPS. Tighten to a 15-second refresh and you are down to roughly 125. A browser-side or mobile fleet blows through that immediately. GitLab's answer is to run the Unleash Proxy yourself, which is a real service to deploy, scale and monitor, and each instance only serves the single environment named in UNLEASH_APP_NAME.
The tripwire · SDK drift
Newer Unleash SDKs dropped the field GitLab authenticates with
GitLab's auth relies on instanceId. Newer Unleash clients (the Node v6 line, for example) removed that config option, and the result is a 401 from /api/v4/feature_flags/unleash/{PROJECT_ID}/client/features that looks like a bad token rather than a version mismatch. There are open GitLab issues about it. This is the structural cost of consuming a client library through a compatible-but-separate server: you inherit someone else's upgrade path. Pin your SDK version, and read the changelog before you bump it.
04 · The honest fork
Should you just use GitLab? Often, yes.
Use GitLab's flags
Stay put if all of this is true
- Your code already lives in GitLab and you do not want another vendor, another bill or another SSO integration.
- You are comfortably under 50 flags per project, and you actually clean flags up.
- Percentage rollouts and user lists cover your targeting. You do not need rules on plan, country or any custom attribute.
- You already have an analytics stack, and you are fine defining exposure events and reading results there.
- Your client count is server-side and modest: dozens of backend processes polling, not thousands of browsers.
If that is you, use GitLab. It is free, it is already there, and paying anyone (including us) for it would be a waste of your budget. Take the feature toggle hygiene advice and skip the vendor.
You have outgrown them
Move on when any of this is true
- You are deleting healthy flags to stay under the cap, or paying for a tier purely to raise it.
- You need targeting by attribute: plan tier, region, account age, beta opt-in, internal staff.
- You want the result of the rollout, not just the rollout: exposure, conversion, guardrail metrics, significance.
- Your flags are evaluated in browsers or mobile apps and 500 polling clients is not a number you recognize.
- You are about to stand up and operate the Unleash Proxy, per environment, to buy headroom.
- You need audit reporting on Free, or a kill switch with a convergence time you can state out loud.
That is the gap a feature flags platform is for: attribute targeting, a real gradual rollout workflow, built-in A/B testing and a one-click kill switch.
05 · Side by side
GitLab flags vs Toggled, without the marketing
GitLab wins the first three rows outright, and we are not going to pretend otherwise: it is already in your GitLab, it costs nothing extra, and it adds zero vendors to your stack. Everything below that line is where we think a dedicated platform earns its place.
| Dimension | GitLab feature flags | Toggled (planned) |
|---|---|---|
| Extra vendor | None. It is already in GitLab. | Yes, one more service to trust. |
| Extra cost | $0, included on Free | Flat per team: $49 / $149 / $499 per month, planned |
| Setup time | Minutes, if your code is in GitLab | Minutes, but a new account and SDK |
| Flags included | 50 (Free) / 150 (Premium) / 200 (Ultimate) per project | Unlimited flags, unlimited seats, every plan |
| Targeting by custom attribute | None documented | Rules on any context field: plan, country, org, cohort |
| Percentage rollout | Yes, with stickiness options | Yes, one slider, consistent hashing |
| Anonymous traffic | User ID required for percent-of-users and user-ID strategies | Anonymous keys supported |
| A/B testing and metrics | None documented, bring your own analytics | Built in from the first plan |
| Kill switch | Toggle the flag off, clients pick it up on next poll | One click, about 3 second convergence target |
| Client scale | Approx 500 polling clients (8 RPS), then run the Unleash Proxy | Managed edge, no proxy for you to operate |
| Audit trail | Events exist since 15.10, but reporting needs Premium or Ultimate | Audit history on the plan, not a tier upsell |
| SDKs | Any Unleash client, with the instanceId version caveat | First-party SDKs, one evaluation core |
| Status | Shipping and supported today | Early access, launching soon |
Read that last row before you decide anything. GitLab's flags are shipping and supported today; Toggled is in early access. Our planned pricing is flat per team with unlimited flags and unlimited seats, so the 50-flag conversation stops happening. The numbers are on the pricing page, and if you are weighing self-hosting instead, the honest math is in open-source feature flags vs a managed platform.
06 · FAQ
Questions people actually search
Does GitLab have feature flags?
Yes. GitLab ships feature flags on every tier (Free, Premium and Ultimate) and on GitLab.com, self-managed and Dedicated. You find them in a project under Deploy > Feature flags. They are not deprecated and not removed: they are still documented and supported in GitLab 19.x as of July 2026.
Are GitLab feature flags free?
Yes. Feature flags work on GitLab Free, including the full REST API, which has been available on Free since GitLab 13.5. Free caps you at 50 flags per project on GitLab.com. What Free does not give you is audit event reporting, which requires Premium or Ultimate, and the higher flag caps.
How many feature flags can you have in GitLab?
On GitLab.com the documented cap is 50 feature flags per project on Free, 150 on Premium and 200 on Ultimate. Self-managed instances default to 200 per project, and an administrator can raise or lower that through the project_feature_flags application limit. The cap counts per project, not per group.
Do GitLab feature flags use Unleash?
Yes, GitLab feature flags are based on Unleash. GitLab does not run the Unleash server for you: it implements its own Unleash-compatible backend. You integrate with standard Unleash SDKs pointed at GitLab's API URL, using an Instance ID and an Application name, where the Application name is really the environment name.
Can you A/B test with GitLab feature flags?
You can split the traffic, but you cannot analyze it inside GitLab. The feature flag docs cover percentage rollout strategies and document no flag-level metrics, guardrails or statistical results. Any A/B analysis has to happen in an external analytics or experimentation tool that you wire up and maintain yourself.
How do I use GitLab feature flags in my code?
Install an Unleash SDK for your language, then configure it with three values from Deploy > Feature flags: the API URL, the Instance ID and the Application name (which is the environment name, for example production). Call isEnabled with a user context, because percent-of-users and user-ID strategies need a user ID.
What are the limitations of GitLab feature flags?
Four main ones: a 50-flag-per-project cap on Free; only the documented strategies (all users, percent rollout, percent of users, user IDs, user lists) with no custom-attribute targeting; no experiment analytics in the docs; and a polling ceiling of roughly 500 clients (8 RPS) before you must run the Unleash Proxy.
Early access · launching soon
Hit the GitLab ceiling? Keep the workflow, drop the limits
Unlimited flags, attribute targeting and built-in A/B testing on flat per-team pricing. Join the early-access list, no card required.
No card required · your data stays yours
Keep exploring
More feature flag resources
- PostHog Feature Flags
- Datadog Feature Flags
- Vercel Feature Flags
- AWS Feature Flags
- Azure Feature Flags
- Harness Feature Flags
- Trunk Based Development
- Canary Deployment Made Simple With Feature Flags
- Feature Toggle Management for Engineering Teams
- Gradual Rollout
- Feature Flag Kill Switch
- React Feature Flags