Why fail-open?
As a billing engine, Autumn sits in the critical path of your application. If your app callscheck() to gate access to a feature, and Autumn is unreachable, that call would throw an error — effectively blocking your users from accessing your product.
Fail-open ensures your users are never blocked by an Autumn outage. Usage events may be lost during the outage, but your customers stay unaffected.
If you run the edge cache, checks keep working through an outage, answered from the last balances Autumn sent it.
Behavior
Fail-open is enabled by default. When Autumn is unreachable (network errors, timeouts, or server errors returning 5XX status codes), the SDK returns safe defaults:
Customer and entity operations, including
customers.getOrCreate(), customers.get(), entities.get(), and entities.create(), propagate errors even when fail-open is enabled. Only check() and track() return fail-open defaults.
When fail-open triggers
Fail-open activates when the SDK encounters:- Server errors — Autumn returns a 5XX status code (500, 502, 503, etc.)
- Network failures — DNS resolution failure, connection refused, connection reset
- Timeouts — The request to Autumn times out
Configuration
Disabling fail-open
If you prefer strict error handling and want all Autumn errors to propagate:Detecting fail-open responses
Whencheck() fails open, the response will have allowed: true with empty values: