A feature flag in general needs presence on both the frontend and backend because a change may coordinate between the two. More properly due to frontend cachin

A feature flag in general needs presence on both the frontend and backend because a change may coordinate between the two. More properly due to frontend caching issues an HTTP request should include a header with the active features, separately from the header containing the auth token. And that gives a first semantic difference: feature flags take effect when the app is updated/reloaded, auth changes take effect immediately.