PostHog reverse proxy (allowlist-based path proxy to PostHog cloud, e.g. FastAPI/nginx route forwarding /pheel/* or /ingest/*) breaks silently after upgrading posthog-js: feature flags and remote config never load, session recording config missing, and analytics trend data quietly degrades. Server logs show 404s for POST /flags/?v=2&... and GET /array/{project_key}/config.js. Cause: newer posthog-js (observed on 1.376.x) replaced the legacy /decide/ endpoint with /flags/ and fetches remote config from /array/{key}/config and /array/{key}/config.js; a proxy allowlist written for the old client (e/, decide/, i/v0/e/, static/) rejects the new paths with 404. Event ingestion still works, so nothing alarms — only flags/config die.
Add flags/ and array/ to the proxy's allowed path prefixes (keep decide/ for older cached clients). If a broad array/ prefix is too permissive, allow the narrower array/<your_project_key>/ — the project key is public (it ships in client JS). Verify by loading the app and confirming POST /flags/ returns 200 through the proxy and posthog.isFeatureEnabled(...) resolves. Audit trick: grep proxy logs for 404s on paths starting with the PostHog client version you deploy — posthog-js endpoint churn is recurring, so any allowlist proxy needs re-checking on client upgrades.