flitz plugins

Resolve the loader-plugin version for your pinned SDK and store the plugin-repository credentials.

To run bundles inside your own app you embed the Flitz loader plugins in its Android and iOS builds. The plugins live in private repositories gated by the same organization license as the SDK. Two commands cover the CLI's side of that, each doing one thing:

flitz plugins configure                  # which version, and which repositories
flitz plugins credentials --write        # store the repository token locally

Both need a credential and an active license. None of them edits your project's build files — that half is documented under Loader plugins, per platform.

How the version is resolved

The loader plugins are versioned independently of the SDK. Each published plugin version declares a floor iteration: the lowest Flitz iteration — the <N> in <flutter-version>+flz.<N> — it supports. The CLI picks the newest plugin version whose floor is at or below your pinned tag's iteration. When the current directory has no flitz.yaml, the target is whatever tag latest resolves to.

The CLI's resolution is recommend-only. It never reads your Gradle, Podfile, or SwiftPM files, so it cannot report installed-versus-recommended drift; it tells you what the project should use for its pinned SDK. For a pinned project, flitz status reports the same resolution in its plugin_version row; without a pin, that row is skipped.

The floor itself is enforced outside the CLI too: building the host fails when the SDK it builds with is below the plugin's floor, and a host whose SDK is below it rejects every bundle with Loader needs a newer SDK. See Compatibility.

When no published plugin version supports the target tag, the command fails with exit 1:

✗ no published loader plugin version supports SDK tag <tag> (iteration <n>); the lowest published floor is iteration <f>
  → run `flitz sdk use <supported-tag>` to pin a supported SDK

<supported-tag> is the lowest tag on the same Flutter version that meets the floor. When there is none, it reads pin a Flitz SDK at iteration <f> or newer — `flitz sdk releases` lists them. If no loader plugin version is published at all, the command fails with no loader plugin versions are published yet, so none can be resolved for SDK tag <tag> (exit 1).

configure

flitz plugins configure

Loader plugin version: <version>
Resolved for SDK tag:  <tag>

Repositories:
  Maven      https://…
  SwiftPM    https://…
  CocoaPods  https://…

It never prints the repository token.

`--version-only`

For a build script, --version-only prints the bare resolved version on stdout and nothing else. It takes precedence over --json:

PLUGIN_VERSION="$(flitz plugins configure --version-only)"

`--json`

flitz plugins configure --json

{
  "version": "<version>",
  "target_sdk_tag": "<tag>",
  "repositories": { "maven": "https://…", "swift": "https://…", "cocoapods": "https://…" }
}

The token is not in the document. On failure no JSON is emitted; check the exit status first.

credentials

flitz plugins credentials

With no flag, prints what would be stored and where and writes nothing — the command has no side effect until you ask for one:

Flitz loader-plugin credentials — nothing was written. Re-run with
`--write` to store them, or `--print-token` to output just the token.

Gradle reads the entitlement token from /home/you/.gradle/gradle.properties:

  flitzMavenToken=<your-token>

CocoaPods and SwiftPM read it from /home/you/.netrc:

  machine <repository-host>
    login token
    password <your-token>

The plan contains the real token

The printed plan shows your organization's repository token in full, twice. Treat its output like --print-token: keep it out of tickets, chats, and CI logs, and prefer --write, which never prints the token.

Flag	Effect
`--write`	Store the token in `~/.gradle/gradle.properties` (as `flitzMavenToken`) and in one `~/.netrc` entry for the repository host, atomically and at mode `0600`, preserving every unrelated entry in both files. Prints where it wrote, with the token redacted.
`--print-token`	Print the raw token alone on stdout, for piping into another tool. Cannot be combined with `--write` (`--write` and `--print-token` cannot be combined., exit 1).

If you add the loader on iOS through Swift Package Manager, also sign in to the Flitz package registry — see Loader plugins → Credentials.

The token goes into your developer-local stores only. Never write it into a committed file — the repository URLs belong in your build files, the token does not. flitz status reports whether the stores hold one (plugin_credentials).

Loader plugins overview — what the loader does and what the host must provide.
Android and iOS — the build-file integration.
Compatibility — what must match between the host, its loader plugin, and every bundle.

How the version is resolved

configure

--version-only

--json

credentials

Related

On this page

`--version-only`

`--json`