Guides

HTTP 401 Error Explained: Causes and How to Fix It

A graphic of a bar chart with an arrow pointing upward.

The HTTP 401 error is misnamed, and that single fact causes more debugging confusion than almost anything else about it.

The spec calls it "Unauthorized," but it actually means "unauthenticated" — the server doesn't know who you are yet, not that it knows and disagrees with your access level. That distinction determines everything: what caused the error, how to fix it, and what your API should do when it returns one.

This article is for developers, engineers, and technical PMs who are either troubleshooting a 401 in the wild or building APIs that need to return the right status codes. Here's what you'll learn:

  • What HTTP 401 actually means — and why the official name misleads even experienced engineers
  • The most common causes, from expired tokens to stale browser cookies to OAuth-specific token failures
  • How 401 and 403 differ, and why mixing them up breaks API clients in specific, hard-to-trace ways
  • Step-by-step fixes for both end users and developers, including an infrastructure gotcha with AWS CloudFront
  • How to emit 401 correctly in your own API design so clients can handle it reliably

The article moves from definition to diagnosis to fixes to design — so whether you're stuck on a specific error right now or building the system that returns these codes, you can jump to the section that fits your situation.

What the HTTP 401 status code actually means

Before you can diagnose or fix a 401, you need a precise definition — and the official name of this status code actively works against you. "401 Unauthorized" is what the spec calls it, but what it actually means is closer to "unauthenticated."

MDN's documentation acknowledges this directly: "Although the HTTP standard specifies 'unauthorized', semantically this response means 'unauthenticated'." That single naming quirk is responsible for a surprising amount of confusion, even among experienced engineers.

The Hacker News community has flagged it repeatedly — one developer noted they need to "pause for a few hundred milliseconds just to be sure I'm using the right one in a sentence." If that resonates, this section is for you.

Authentication failure, not a permissions problem

The precise definition from MDN: a 401 indicates "a request was not successful because it lacks valid authentication credentials for the requested resource." The operative concept is identity, not permission. The server isn't saying it knows who you are and has decided to block you — it's saying it cannot determine who you are at all. SuperTokens frames it cleanly: "the server has failed to identify the user."

This distinction matters because it determines what corrective action is even possible. A 401 is fundamentally about the who, not the what. You haven't been denied access to a resource; you haven't been recognized as anyone yet. The server is waiting for you to prove your identity before it will evaluate anything else.

A useful three-way framing: 401 means "I don't know who you are." 403 means "I know who you are, but you can't come in." 404 means "I have no idea what you're looking for." These aren't interchangeable states — they require different responses from the client and signal different conditions in your system.

The WWW-Authenticate header: the server's instructions for recovery

What separates a 401 from a generic failure is a required companion: the WWW-Authenticate response header. Per the HTTP specification, when a server returns 401, it must include this header, which tells the client exactly which authentication scheme it needs to use to succeed on a retry.

A concrete example from MDN: a GET /admin request without credentials returns HTTP/1.1 401 Unauthorized alongside WWW-Authenticate: Bearer. That header isn't incidental — it's the server's explicit instruction that Bearer token authentication is required. The client now knows not just that the request failed, but precisely how to fix it.

This is what makes 401 a structured, actionable error rather than a dead end. The server isn't just rejecting the request; it's providing a recovery path. Basic, Bearer, Digest, and others are all valid values — and each tells the client something specific about what credentials to supply.

Why 401 is temporary and correctable

Because a 401 signals missing or invalid credentials rather than a permanent access denial, it describes a state the client can resolve. Authenticate correctly — supply the right token, the right credentials, the right scheme — and the server can evaluate the request on its merits.

This is the critical contrast with 403. A 403 response means the server has successfully authenticated the requester and has still decided to deny access. There is no credential the client can supply to change that outcome. Reauthenticating won't help; the problem isn't identity, it's authorization policy.

The presence of the WWW-Authenticate header reinforces this: it's the server's invitation to try again with proper credentials. A 403 carries no such invitation, because there's nothing to try again with.

For developers and technical PMs building or debugging systems, this distinction isn't academic. Treating a 401 as a 403 — or vice versa — produces real failures: an API client that receives a 403 but thinks it's a 401 will keep refreshing its token and retrying, never realizing that the problem is permissions, not credentials.

An API client that receives a 401 but treats it like a 403 will give up immediately on a request it could have fixed with a fresh login. The rest of this article builds on this foundation, so it's worth holding the definition precisely: 401 means the server cannot identify you, and it has told you how to fix that.

Four reasons a server returns 401 — and which context each belongs to

A 401 error has a specific meaning — the server doesn't know who you are — but the reasons that situation arises vary considerably depending on whether you're a user hitting a login wall or an engineer debugging an API integration.

The four cause categories below map to those two contexts: the first three tend to surface in browser-based sessions, while the fourth is almost exclusively a developer-facing problem in API and OAuth flows. Identifying which category fits your situation is the fastest path to the right fix.

Missing or incorrect credentials

The most straightforward cause: the request arrived at the server without valid credentials, either because none were provided at all or because the ones provided were wrong. For a human user, this is a mistyped password or a username that doesn't match any account. For a programmatic client, it's an API request that went out without an Authorization header entirely.

MDN's canonical example illustrates this cleanly: a GET /admin request that includes no Authorization header receives a 401 Unauthorized response with a WWW-Authenticate: Bearer header in reply. The server isn't saying you're forbidden — it's saying it has no idea who's asking.

The fix in this case is straightforward — provide the right credentials — but you first have to confirm that credentials are actually missing rather than present but invalid.

Expired tokens or sessions

This cause is distinct from wrong credentials because authentication succeeded at some point. The user or client authenticated correctly, received a valid credential, and then that credential aged out. A session cookie that timed out after inactivity, or a JWT whose exp claim has passed, will both produce a 401 on the next request even though the underlying identity is perfectly valid.

The server isn't rejecting the identity — it's rejecting the credential's current state. This distinction matters for debugging: if you're seeing a 401 that appears intermittently or only after a period of inactivity, an expired token or session is the most likely culprit.

For API clients using short-lived access tokens, this is a routine operational condition that should be handled programmatically with a token refresh flow rather than treated as an error requiring human intervention.

Stale browser cache and cookies

A browser can produce a 401 by sending authentication cookies from a previous session that are no longer recognized by the server. This is related to but distinct from token expiry: the issue here is the browser's stored state, not the token's own expiration timestamp.

A server-side session invalidation — a forced logout, a password reset, or a backend session store flush — can leave the browser holding cookies that the server no longer considers valid.

Users who clear their cache and cookies and find the 401 disappears were almost certainly in this situation. The credential wasn't wrong and it wasn't expired on its own terms — the server simply stopped recognizing it, and the browser kept sending it anyway.

API and OAuth-specific token issues

For engineers working with API integrations, the 401 cause landscape expands. Beyond a missing Authorization header, common triggers include a revoked OAuth access token, a token issued for the wrong scope or audience, or a token that was valid when the integration was built but has since been invalidated by an authorization server event — a user revoking app access, an admin rotating credentials, or a connected application being deauthorized.

A revoked OAuth token is particularly worth calling out because it can look identical to an expired token from the client's perspective. The token hasn't hit its expiration timestamp, but the authorization server has marked it invalid. The WWW-Authenticate: Bearer response header the server returns is the signal that a Bearer token is required — or that the one provided is no longer accepted. In these cases, the fix isn't a simple retry; it requires obtaining a new token through the authorization flow.

Infrastructure-level 401s are also worth acknowledging, even if they're less common. Intermittent 401s on services using Windows Authentication in IIS, for example, can appear even when credentials are valid — a reminder that not every 401 is a straightforward credential problem, and that the server's authentication stack itself can be a variable.

HTTP 401 vs. 403: why the wrong code breaks client behavior

Before you can reliably troubleshoot a 401 or design an API that returns the right error code, you need to understand what separates these two responses at a fundamental level. They're not interchangeable, and treating them as roughly equivalent is one of the more consequential mistakes in API design.

401 and 403 represent different points in the access control pipeline

A 401 and a 403 represent different points in the access control pipeline — authentication and authorization — and conflating them means conflating two distinct server states.

When a server returns a 401, it's saying it cannot identify the requester. The request arrived without valid credentials, with credentials that couldn't be verified, or with no credentials at all. As Permit.io puts it, the server is essentially saying: "I don't recognize you." A 403, by contrast, is returned after the server has successfully identified the requester — and is still refusing access. The user is known; they just don't have permission to touch that resource.

A useful analogy: a 401 is like showing up to a locked building with no key at all. A 403 is like having a key that works on the front door but not on the server room. In the first case, the problem is that you haven't established who you are. In the second, your identity is established — you're just not allowed in.

There's a naming trap worth calling out directly. The 401 status code is labeled "Unauthorized," which misleads a surprising number of developers into treating it as a permissions error. It isn't. The label is a historical artifact. The code is strictly an authentication signal — the server doesn't know who you are, not that it knows and disagrees with your access level. "Unauthenticated" would be more accurate, and that's the mental model you should carry.

What each code tells the client to do next

The distinction isn't just semantic — it has direct implications for how clients should respond.

A 401 response must include a WWW-Authenticate header (per RFC 9110), which is an explicit protocol-level instruction: provide valid credentials and try again. This is what makes a 401 a correctable, temporary state. The server is not slamming the door permanently; it's telling the client exactly what it needs to do to proceed.

A 403 carries no such instruction, because reauthentication won't help. The user's identity is already established. The problem is permissions, not credentials. A client that retries with fresh tokens after receiving a 403 is wasting requests — it will keep getting the same answer.

A client that gives up after a 401 is failing to recover from a state that was always fixable. The WWW-Authenticate header is the structural, spec-level signal that separates these two codes — not just a matter of convention.

Why conflating 401 and 403 breaks API design

If an API returns 403 when it should return 401 — because the developer conflated "unauthorized" with "forbidden" — clients cannot implement reliable token refresh or reauthentication flows. They interpret a fixable authentication failure as a permanent permission denial and stop retrying. The user gets locked out of something they should be able to access, and the client has no signal to trigger a login prompt or token refresh.

The reverse mistake is equally damaging. Returning 401 when the user is authenticated but lacks permissions sends clients into reauthentication loops that will never succeed, because the problem isn't credentials — it's access control policy.

The distinction is well-understood among practitioners who work with API design regularly — the confusion almost always originates on the implementation side, where developers reach for the more familiar-sounding "Unauthorized" label without reading what the spec actually requires.

The bottom line: use 401 when the request lacks valid authentication, and use 403 when the authenticated user doesn't have the required permissions. The codes are not interchangeable, and getting this right is the foundation of a predictable API contract.

Fixing a 401 depends on where in the stack the credential broke down

The fix for a 401 always traces back to the same root cause: the server did not receive valid authentication credentials. What changes is where that breakdown happened — in a browser session, an API request, or somewhere in the infrastructure pipeline between the client and the origin server. Knowing which context you're in determines which fix applies.

Fixes for end users

If you're hitting a 401 in a browser, the server is essentially saying it doesn't know who you are. The path forward is to re-establish your identity through one of three actions.

First, verify that your credentials are actually correct. A mistyped password or an email entered under the wrong account is the most common cause and the easiest to rule out. Second, clear your browser cache and cookies. Stale session data can cause your browser to send an expired or invalidated token on your behalf — the server rejects it, and you see a 401 even though you believe you're logged in. Third, log out completely and reauthenticate. A fresh login generates a new session token or cookie, which gives the server the valid proof of identity it's looking for.

These three steps resolve the majority of browser-side 401s. If you've done all three and the error persists, the problem is likely on the server or infrastructure side — which is where developers need to take over.

Fixes for developers: confirming the Authorization header is transmitted

For developers, the diagnostic starting point is the Authorization header. According to the MDN specification, when a server returns a 401, it includes a WWW-Authenticate header in the response that tells the client exactly what authentication scheme is expected — for example, WWW-Authenticate: Bearer signals that the server expects a Bearer token in the Authorization header of the next request. If that header is missing, malformed, or carrying an expired token, the server will reject the request.

The critical mistake developers make is assuming the Authorization header is being sent just because it was set in application code. A real-world example from Stack Overflow illustrates this well: an ASP.NET web service using Windows Authentication in IIS6 (Microsoft's web server software) was returning intermittent 401 responses even when valid Active Directory credentials were passed.

The issue was infrastructure-layer — credentials set at the application level weren't reliably forwarded through the underlying server stack. The fix required verifying what was actually being transmitted at the wire level, not just what the application assumed it was sending.

The practical implication: use a tool like curl, Postman, or your browser's DevTools Network tab to inspect the actual outbound request. Confirm the Authorization header is present in the request that reaches the server, not just in your application configuration.

The AWS CloudFront case

One infrastructure gotcha worth knowing: AWS CloudFront strips the Authorization header from requests by default before forwarding them to your origin server. This means a correctly configured application can still generate 401 errors at the origin simply because CloudFront is silently dropping the credential.

The fix is to explicitly configure a cache policy or origin request policy in CloudFront to forward the Authorization header to the origin. If you're running into persistent 401s behind a CloudFront distribution and your application-level auth looks correct, this is the first place to check in your AWS configuration.

Confirming the 401 is resolved: what a successful response looks like

Once you've applied a fix, confirmation is straightforward. A successful resolution means the server returns a 2xx response instead of a 401. For developers, also check that the WWW-Authenticate header is no longer present in the response — its presence is the server's signal that authentication is still required and the fix hasn't taken effect yet.

For API integrations specifically, confirm that the authentication scheme in your Authorization header matches what the server specified in its WWW-Authenticate response. Sending Authorization: Basic credentials to a server expecting Bearer tokens will produce a 401 even if the credentials themselves are valid. The server's WWW-Authenticate header is the authoritative source of truth for what it expects — read it before assuming the credential format is correct.

HTTP 401 in API design: returning the right status code

How you emit a 401 matters as much as how you handle one. For API designers and backend engineers, the status codes your API returns are part of its contract — and getting 401 wrong doesn't just create confusion, it breaks the automated systems that depend on it.

The spec-based case for using 401 correctly

The HTTP specification is unambiguous: a 401 response means the request lacks valid authentication credentials. It does not mean the client is forbidden from a resource, and it does not mean "access denied" in a general sense. That distinction belongs to 403.

A correctly formed 401 response includes a WWW-Authenticate header. This isn't optional. The header tells the client what authentication scheme the server expects, giving the client everything it needs to retry with proper credentials. A minimal compliant response looks like this:

HTTP/1.1 401 Unauthorized
Date: Tue, 02 Jul 2024 12:18:47 GMT
WWW-Authenticate: Bearer

Many production APIs return 401 without the WWW-Authenticate header. That's a spec violation — and it has real consequences. Auth libraries, proxies, and API clients rely on that header to determine how to authenticate. Without it, the client receives a signal that says "try again with credentials" but no information about what credentials to provide or in what format.

The retry expectation baked into 401: what clients are supposed to do

The reason 401 is described as a correctable, temporary state is that the protocol expects a retry. When a client receives a 401, the intended flow is: inspect the WWW-Authenticate header, obtain or refresh valid credentials, and resubmit the request. This is the mechanism that powers token refresh flows in OAuth — the 401 is the trigger that tells the client its access token has expired and needs to be replaced before retrying.

This retry expectation is built into SDKs, API clients, and CI pipelines. It's also increasingly relevant in AI-based automation tools that chain multiple API calls together — these systems read status codes and decide automatically whether to retry, stop, or escalate. A 401 tells them to reauthenticate and try again. A 403 tells them to stop entirely. These are fundamentally different instructions, and automated systems follow them literally — they don't read error messages, they read codes.

The downstream cost of misusing 401 is significant. Returning 401 when the correct response is 403 can trigger infinite retry loops or token refresh storms — the client keeps refreshing its token and retrying, never realizing that the problem isn't authentication at all.

These failures are also difficult to trace in observability tooling, because monitoring systems classify 401s and 403s differently. A flood of 401s looks like an authentication outage; a 403 signals a permissions problem. Misclassification creates noise that obscures the real issue.

API design patterns that corrupt the 401 signal

Several patterns recur in API design that undermine the reliability of 401 as a signal.

The most common is returning 401 when 403 is correct. If the client has authenticated successfully but lacks permission to perform the action, that's a 403 — not a 401. Returning 401 in this case tells the client to reauthenticate, which won't help, because the problem is authorization, not authentication.

A related mistake is using 401 as a generic "access denied" catch-all. Some APIs return 401 for any request that doesn't succeed for security-related reasons, regardless of whether authentication is actually the issue. This collapses meaningful distinctions that clients need to handle errors correctly.

Omitting the WWW-Authenticate header, as noted above, is a spec violation that breaks auth libraries and proxies even when the status code itself is correct.

Finally, there's the anti-pattern of returning 200 OK with an error payload instead of a proper 4xx code. This breaks all programmatic error handling — clients that check status codes before parsing response bodies will treat the request as successful and potentially propagate the error silently.

The recommendation here is straightforward: use 401 when and only when the request lacks valid authentication credentials, always include the WWW-Authenticate header, and reserve 403 for permission failures. APIs that follow this contract give their consumers — whether human developers or automated agents — the information they need to respond correctly.

Diagnosing a 401: the distinction that separates a fast fix from a long debug

The through-line of this entire article is a single, precise distinction: a 401 means the server cannot identify you, not that it has identified you and said no. That's a 403. Holding that distinction clearly is what separates a fast diagnosis from a long debugging session — and what separates a well-designed API from one that sends its consumers into retry loops they can never escape.

Quick diagnostic: is it an authentication problem or a permissions problem?

The fastest question to ask when you see a 401 is: has this request ever succeeded with these credentials? If yes, the credential has likely expired, been revoked, or been dropped somewhere in the infrastructure layer — none of which are permissions problems.

If the request has never succeeded, start with whether valid credentials were sent at all, and read the WWW-Authenticate header to confirm what the server actually expects.

Resolution path for users and developers

For end users, the sequence is straightforward: verify your credentials are correct, clear your browser cache and cookies, and reauthenticate with a fresh login. For developers, the discipline is to inspect what's actually transmitted at the wire level — not what your application assumes it's sending.

A curl request or a DevTools network trace will tell you whether the Authorization header is present, correctly formatted, and carrying a token that matches the scheme the server specified. If those check out and the 401 persists, the problem is likely upstream of your application code.

When to escalate: infrastructure, proxy, and API gateway issues

The AWS CloudFront case is the canonical example, but it's not the only one: any proxy, CDN, or API gateway sitting between your client and origin server is a candidate for silently stripping or transforming the Authorization header.

If your application-level auth looks correct and you're still getting 401s, the next step is to test a direct request to the origin, bypassing the intermediary entirely. If that succeeds, the problem is in the layer between — and the fix is a configuration change, not a code change.

Where to start, whether you're debugging or designing

The tension worth keeping in mind: precision in error codes feels like a small thing until it isn't. A 401 returned where a 403 belongs will eventually produce a token refresh storm or a silent retry loop in an automated system, and those failures are genuinely hard to trace. The cost of getting this right is low; the cost of getting it wrong compounds quietly over time.

Start with where you are:

If you're a user seeing a 401 in a browser: Clear your cache and cookies, log out, and reauthenticate. If the error persists after a fresh login, the problem is on the server side — contact support or your IT team.

If you're a developer debugging a live 401: Open your network inspector and check two things: (1) Is the Authorization header present in the outbound request? (2) Does the scheme in your header match what the server specified in WWW-Authenticate? If both check out and the 401 persists, test a direct request to the origin to rule out a proxy or CDN stripping the header.

If you're an API designer auditing your error responses: Find every place you return a 401 and ask: has the client authenticated? If yes, the correct code is 403, not 401. Find every 401 that lacks a WWW-Authenticate header and add one — it's required by the spec and expected by auth libraries.

If you're building APIs that gate access to features or experiments, GrowthBook's feature flagging and experimentation platform relies on clean authentication signals from your backend — a correctly formed 401 with a WWW-Authenticate header is what allows token refresh flows to complete reliably before flag evaluations run.

This article was written to be genuinely useful whether you're staring at a 401 right now or designing the system that returns them — and if it helped you get unstuck or think more clearly about the problem, that's exactly what it was for.

Related reading

Table of Contents

Related Articles

See All Articles
Experiments

Degrees of freedom in statistics, explained simply

Nov 5, 2026
x
min read

The same test statistic can support different conclusions when its degrees of freedom change.

You open an experiment report and see a t-statistic, a p-value, and a number labeled df. It might be 49, 118, or 19.48. That last value is not a typo. Degrees of freedom do not always equal the number of users minus 1, and they do not always come in whole numbers.

Degrees of freedom describe the independent variation available to a particular calculation or index the reference distribution used for inference. In familiar variance calculations, constraints explain them directly. In methods such as Welch's t-test, an approximation produces an effective value instead.

For experimentation, the useful question is specific: which calculation produced this df, and does that calculation match the data? Understanding that connection helps you spot wrong denominators, mismatched tests, and confidence intervals built from the wrong reference curve.

Start with the constraint behind n minus 1

Three observations, two freely varying deviations

Take a hypothetical sample of 3 measurements: 2, 4, and 6. Their mean is 4. Subtract that sample mean from each measurement and the deviations are -2, 0, and 2.

Those deviations sum to zero. They must: the mean was calculated from the same values. Once you know the mean and the first 2 deviations, the last deviation is determined. If the first 2 sum to -2, the last must be 2.

This is the intuition behind n - 1 degrees of freedom for the usual sample variance. There are n deviations but 1 independent linear constraint. Their possible patterns occupy n - 1 independent directions. You have not discarded a person or stopped using a measurement. All 3 values still contribute to the variance calculation.

You can see the arithmetic in this sample. Squaring the deviations gives 4, 0, and 4, for a total of 8. Divide by n - 1, which is 2, and the sample variance is 4. The sample standard deviation is its square root, or 2.

Why estimating the mean changes the denominator

The sample mean is fitted to the observed data. Deviations from that fitted mean tend to be smaller than deviations from the unknown population mean. For independent observations from the same distribution with finite variance, dividing their squared sum by n - 1 corrects the downward bias in the variance estimate.

The usual sample variance and one-sample t calculation therefore share the n - 1 quantity. This does not make the sample standard deviation itself exactly unbiased; taking the square root is a separate operation.

If your dataset is the entire finite population you want to describe, averaging squared deviations over n is a legitimate descriptive calculation. The denominator depends on the target. Estimating variation in a larger population is different from describing the values you already have.

Keep the intuition within its scope

“Independent observations minus fitted parameters” is useful for ordinary linear models, but it is not a universal df calculator. You must know what statistic is being calculated and what constraints or approximations apply.

Even a software parameter called ddof needs interpretation. The degrees-of-freedom adjustment in a standard-error calculation controls a variance denominator. It is not an instruction to use the same number as the reference df for every later test. A variance correction, a model's residual df, and a test's reference df are related concepts, not interchangeable labels.

See how df changes a statistical threshold

A t-statistic needs a reference curve

A t-statistic expresses an estimated difference relative to its estimated standard error. Its interpretation depends on the reference t distribution, whose shape is indexed by df. Low-df t distributions have heavier tails, reflecting uncertainty in the variance estimate under the model.

For a prespecified two-sided test at a 5% significance level, compare the absolute t-statistic with the appropriate 97.5th percentile. The t critical-value table gives approximately 2.776 at 4 df and 1.984 at 100 df.

Suppose two separate hypothetical analyses each produce t = 2.1. At 4 df, that value does not cross the 5% threshold. At 100 df, it does. The difference is not a judgment about the product feature. It follows from the reference distributions used to assess sampling uncertainty.

The reference distribution must itself be appropriate. Exact one-sample t inference assumes independent, normally distributed observations; large-sample approximations can cover broader settings. A small df does not automatically make a test invalid, but it gives you little protection against a poor distributional approximation. For highly skewed revenue measured on a handful of users, looking up the correct df is only one part of assessing the method.

Degrees of freedom are not the effect size

Larger df do not mean a bigger lift or a better variant. A tiny effect in a large sample can have high df. A large but imprecise effect in a small sample can have low df. You still need the effect's units, its interval, and a business threshold for deciding whether it matters.

Nor should you interpret df as statistical power. Power depends on the effect size you want to detect, variability, allocation, sample size, significance rule, and design. Use power analysis before launching an experiment to plan sensitivity. Reading a large df after the experiment does not replace that work.

Make small effects easier to detect

Degrees of freedom are only one part of uncertainty. Explore metric design and variance reduction techniques that can improve an experiment's sensitivity.

Explore Variance Reduction

Choose the formula for the method you actually use

One sample, pairs, and pooled groups

For a one-sample t-test, n independent observations give n - 1 df. For a paired t-test, calculate a difference within each pair, then analyze those independent differences. With 30 complete pairs, the usual paired test has 29 df, not 59.

For the pooled two-sample t-test, the common variance estimate combines the two groups' variance information. Its df are nA + nB - 2. The test assumes equal population variances as well as independent groups. You should not select that formula merely because you have an A/B experiment.

CalculationUsual degrees of freedomWhat must be counted correctly
One-sample t-testn - 1Independent observations in the sample
Paired t-testNumber of complete pairs - 1Independent pairs, not both measurements separately
Pooled two-sample t-testnA + nB - 2Independent group sizes and the common-variance assumption
Welch's two-sample t-testWelch-Satterthwaite approximationEach group's size and variance
Ordinary least-squares residual variancen - rank(X)Usable rows and independent columns of the design matrix
Chi-square independence test(Rows - 1) × (Columns - 1)The contingency table's category structure

These are method-specific formulas, not options to try until a result becomes significant.

Welch can produce fractional df

Welch's t-test estimates each group's variance separately. Its reference degrees of freedom depend on how much each estimated variance contributes to uncertainty in the difference.

Consider a hypothetical revenue comparison with 20 independent units in group A and 100 in group B. The sample standard deviations are $20 and $5. For the absolute mean difference, the variance contributions are 20²/20 = 20 and 5²/100 = 0.25. Their sum is 20.25, giving a standard error of $4.50.

The Welch-Satterthwaite calculation is:

vA = sA^2 / nA
vB = sB^2 / nB
df = (vA + vB)^2 / (vA^2 / (nA - 1) + vB^2 / (nB - 1))

Here it gives approximately 19.48 df, even though there are 120 units in total. Most of the estimated uncertainty comes from the small, variable group A. Adding observations only to the already precise group B cannot remove that bottleneck.

Using 118 df because 20 + 100 - 2 = 118 would substitute the pooled method's assumptions. Rounding 19.48 up to 118 is not a harmless simplification. Let the chosen method calculate its df rather than overriding it from the total headcount.

Regression and count tables constrain different things

For ordinary least squares, residual df equal observations minus the design matrix's rank. With 100 usable observations, an intercept, and 2 nonredundant predictors, the rank is 3 and residual df are 97. Include the intercept in that count. Redundant predictor columns do not each add an independent fitted direction.

If the model fits an independent parameter for every usable observation, residual df can fall to zero. An exact fit then leaves no residual information for the usual error-variance estimate. Adding predictors until the observed data fit perfectly is not evidence that future outcomes will be predicted perfectly. A model's flexibility and its evidence for uncertainty are different things.

Ordinary one-way ANOVA illustrates another reason to read the label carefully: its F reference distribution has 2 df values. For k groups and N independent observations, the between-group and error degrees of freedom are k - 1 and N - k. A hypothetical comparison of 3 variants across 90 observations has F reference df of 2 and 87. The corrected total is 89, which equals their sum. Reporting only “df = 89” would omit the information needed to identify that F distribution. These formulas belong to the ordinary one-way model with its variance assumptions; they are not a recipe for every repeated-measures or unequal-variance ANOVA.

A chi-square test of independence uses a different structure. A 2-dimensional contingency table has (rows - 1) × (columns - 1) df. A 2-by-2 variant-by-conversion table has 1 df, whether it contains 200 users or 200,000. More traffic improves precision; it does not change the number of category relationships tested.

This is why df cannot serve as a universal substitute for sample size. Its meaning comes from the statistic and model.

Check the experimental unit before trusting a large df

Repeated events do not create independent users

Suppose you assign 1,000 users to a new experience and record 50,000 pageviews. A user-level treatment comparison does not gain 49,999 df just because the event table has that many rows. The same person's repeated events can be correlated.

Aggregate outcomes or model their dependence in a way that matches the design. A revenue-per-user metric, for example, can sum each user's eligible purchases over a fixed window before comparing groups. Explicit metric and Fact Table definitions help make that relationship between event rows and analyzed units inspectable.

Group assignment creates another case. If treatment is assigned to organizations, employees within an organization share an assignment and may influence one another. A cluster experiment needs inference that accounts for that structure. Plugging the number of employees into an ordinary independent-observation formula does not make the dependencies disappear.

Missingness changes the usable data

Check the data used for the specific metric, not only the experiment's top-line traffic count. Different metrics can have different valid windows, available measurements, or exclusions. In a paired analysis, incomplete pairs can reduce the number of usable differences.

That numerical reduction is only part of the issue. If treatment influences whether an outcome is observed, complete-case analysis can change who gets compared. A plausible df cannot tell you whether the missingness mechanism introduced bias.

Investigate a surprising value by tracing the inputs: which observations survived, what identifier defined an independent unit, what model was fitted, and whether the output uses an approximation. Treat df as a diagnostic clue rather than a quality certificate.

Also distinguish statistical df from the phrase “researcher degrees of freedom.” The latter refers to choices such as which metric, segment, exclusion, or analysis to report. Exploring those choices after seeing results can change the interpretation of evidence. It does not change the arithmetic identity n - 1 for a particular sample variance. Record the planned analysis and label exploratory follow-ups so a reader can distinguish the two issues.

Report the method behind the number

Keep df attached to the estimate and interval

A useful report names the test, the usable group sizes or pair count, the estimated effect, its standard error or interval, and the reference df when relevant. “Welch's t-test, df = 19.48” tells a reviewer more than “t-test, 120 observations.” Neither replaces an explanation of the experiment's assignment and measurement rules.

When reproducing a result, preserve the method's assumptions and software settings. A pooled t-test, a Welch test, and a model with clustered standard errors can analyze similar-looking columns while making different inferential calculations. Matching the displayed row count is not enough to reproduce the p-value.

GrowthBook's frequentist statistical calculations use a t reference distribution with degrees of freedom estimated through the Welch-Satterthwaite approximation. Its statistics overview also distinguishes frequentist and Bayesian engines. A df formula from one approach should not be inserted into the interpretation of another approach's output.

Resolve design problems before chasing precision

Before your next experiment, verify the unit of assignment and analysis, define the metric window, and choose the estimator and decision rule. Those decisions determine what information the analysis can use.

The stopping rule matters separately. A correct df does not authorize repeatedly inspecting a fixed-horizon p-value and stopping when it passes. If you need continuous decision-making, use a suitable method such as GrowthBook's frequentist sequential testing within its documented scope.

You rarely need to calculate degrees of freedom by hand in a production experiment. You do need to recognize when the reported value reflects the wrong test or the wrong independent unit. Start with the design, follow the calculation, and read the effect with its uncertainty. The df will then be an interpretable part of the result.

Build a test you can explain

Define your experiment's metrics and data source in GrowthBook, then review the treatment effect with its uncertainty and documented analysis method.

Get Started With GrowthBook
Experiments
Feature Flags

Server-side vs. client-side A/B testing

Nov 3, 2026
x
min read

Choosing where a variant runs is only the first architecture decision.

A checkout experiment can make its decision on the server, render in the browser, and measure purchases in a warehouse. Calling it “server-side” tells you little about whether the person received the assigned experience or whether their purchase joined to the right group.

Server-side testing evaluates or executes treatment logic in a backend service before returning its result. Client-side testing evaluates or applies treatment logic in the user's browser or application. Both can support randomized experiments. Both can fail through inconsistent identity, incorrect exposure events, or measurement that changes with the treatment.

The useful comparison starts with the change you want to test. A ranking algorithm belongs near the service that runs it. A browser interaction may belong in the application that renders it. Then work through the entire path from assignment to outcome, including the cache, navigation, and login transitions between them.

Separate the experiment's four locations

Assignment is different from treatment delivery

Assignment selects a variant for an eligible unit. Delivery makes the application behave according to that variant. They often happen together, but they do not have to.

For example, an edge worker can select a layout and a browser can render it. A backend can select a recommendation algorithm and return its results as JSON. A browser can select a button label without involving the server in that decision. The same statistical question can sit behind any of these implementations.

Describe the architecture with verbs: who assigns, who executes, who records exposure, and who computes the metric. That description is more useful than the label “full stack.” GrowthBook supports feature flags on the client and server, but you still choose which code consumes each flag and which system supplies the outcomes.

Exposure and analysis can live elsewhere

An exposure record should represent the experiment event your analysis is designed to use. An SDK evaluation callback tells you that an evaluation enrolled a user; it is not proof that the corresponding screen was visible or that a response reached a person.

If you evaluate a checkout flag during application startup but never use its value, the callback can precede any relevant treatment. If you log after the page finishes loading, a slower treatment can lose more events before the logger runs. Both mistakes change what the experiment population means.

Analysis has another location. With warehouse metric definitions, you can join assignment records to purchases or retention data already collected in your own data system. Running the branch on a server does not mean the server SDK has automatically captured or analyzed those outcomes.

Compare complete delivery paths

DecisionBrowser implementationServer implementationHybrid implementation
Where treatment executesBrowser UI or application behaviorBackend logic, API behavior, or rendered responseDifferent parts execute in different runtimes
Main implementation dependencyFrontend code or an eligible visual changeBackend deployment and service integrationShared identity and explicit ownership across layers
First-render concernApply the intended experience before visible replacementReturn the intended response without avoidable delaysPreserve the server result during hydration
Measurement concernBlocked, delayed, or missing client eventsJoin server assignment to actual delivery and outcomesAvoid duplicate or contradictory exposure records
Cache concernStale configuration or application stateVariant-specific responses shared incorrectlyCache keys and browser state disagree

These are engineering tradeoffs, not a universal speed ranking. A browser SDK can evaluate configuration already available locally. A server can add network waits if it fetches configuration on the request path. Measure the path you actually deploy.

Put the treatment where it can be implemented faithfully

Use the browser for changes the browser owns

Client-side testing suits interactions such as showing a different onboarding step, changing a filter interface, or selecting a message inside a web application. A developer can implement the variant directly in application code. A visual editing tool is another route for supported page changes, but client-side testing is not limited to editing the DOM after a page loads.

That distinction matters when teams compare ownership. Some changes can be authored by a growth team in a visual workflow; others require frontend engineering even though they run in the browser. The deployment and review process follows the implementation, not the statistical label.

Browser execution can create a visible replacement if the original content paints before the variant is applied. Hiding the entire page until configuration arrives can create a different problem: a long blank screen when the dependency is slow. Prefer an explicit rendering and fallback strategy over assuming every client-side test must flicker or that an anti-flicker snippet has no cost.

Use the server for backend behavior and controlled responses

Server-side testing fits a pricing calculation, search ranker, checkout service, recommendation pipeline, or response assembled before it reaches the browser. You can keep service credentials and confidential implementation details in that environment.

That benefit has a boundary. If you serialize sensitive rules, identifiers, or secrets into HTML or a browser configuration payload, their earlier evaluation on the server does not make the delivered data confidential. Review exactly what crosses the boundary.

Keep authorization independent of experimentation. A flag can select an experience for an already authorized user; it should not be the only check deciding whether that user can access a protected resource. Apply permission validation on requests regardless of the assigned variant. A client can alter browser state and requests, so browser-visible eligibility is especially unsuitable as a security boundary.

Measure performance instead of promising it

Server rendering can avoid a particular after-paint replacement, but it can also increase response time if the new branch is expensive. Client rendering can avoid a backend change while adding JavaScript work or delaying interactivity. Edge execution can shorten one network path while introducing cache and configuration-update concerns.

Compare the control and treatment on the experience people receive. Core Web Vitals distinguish loading, interaction responsiveness, and layout stability. Pair those measures with relevant backend latency and error metrics. A low flag-evaluation time does not describe the cost of the treatment, the configuration fetch, or the event pipeline.

Define fallback behavior before launch. If configuration is unavailable, decide which existing behavior remains appropriate, how the failure is observed, and whether that request belongs in the experiment analysis. Quietly mixing fallback users into an assigned treatment can dilute or distort the comparison.

Choose the smallest complete treatment

Consider 2 hypothetical checkout ideas. One changes the explanation beside a shipping option; the other changes the shipping-price calculation. The first can live in the frontend if that application already has the necessary context. The second belongs with the authoritative calculation so the displayed amount and the charged amount agree.

Combining both into one treatment may be a reasonable product decision, but it answers a broader question. If the experiment wins, you cannot attribute the change to the explanatory copy alone. Write down what differs across arms before deciding which team or runtime will implement it.

For a first integration, keep unrelated behavior identical. Use the existing purchase event and metric definition when they already represent the outcome you need. Changing rendering, pricing, identity and analytics together makes a surprising result harder to diagnose. A small experiment should still include the whole assignment-to-outcome path; small does not mean skipping instrumentation review.

Plan flags across your stack

Extend the architecture decision into ownership, lifecycle management, and production review. Use the feature flag guide to plan how flags will operate as your program grows.

Read the Feature Flag Guide

Keep identity and delivered variants consistent

Scope user attributes to the request

A shared configuration client is useful on a server. Shared mutable user attributes are a different matter. If one request replaces a global user's attributes while another request is evaluating a flag, users can receive each other's targeting context.

The current GrowthBook Node.js SDK supports a shared GrowthBookClient with a user context passed to evaluation, or a scoped instance for that context. Keep the authenticated or anonymous identifier in the request's scope. Do not use an arbitrary user-supplied identifier as authentication merely because it is convenient for experimentation.

Choose the randomization unit deliberately. A user-level experiment needs a stable user identifier; an account-level workflow may need an account identifier. Requests and pageviews are usually repeated measurements of those units, not new independent participants. Every service participating in the same treatment needs the agreed unit and identifier representation.

Treat login and configuration changes as design events

If a visitor is assigned using an anonymous identifier and switches to a different identifier after login, they can receive another variant. That is a design problem to resolve, not a reason to overwrite the old event history.

Document the identity transition, warehouse join, and intended assignment persistence. Sticky bucketing persists assignments for supported workflows; it is distinct from ordinary deterministic hashing with unchanged inputs. It does not make arbitrary identity changes or incompatible configurations equivalent.

For cross-runtime parity, verify the same experiment definition, hash attribute and its type, seed, hashing version, targeting context, and applicable rules. A string identifier and a numeric identifier should not be assumed interchangeable. Matching a few sample users is a useful diagnostic; it is not proof that every production context is equivalent.

Configuration versions also belong in the handoff. A browser tab can hold yesterday's payload while a server uses a newer one. Decide how a running experiment handles configuration refreshes and which changes require a new phase or a new experiment. Record enough metadata to diagnose disagreements without sending confidential configuration into public events.

Treat an SDK upgrade as a change to verify, too. The official JavaScript SDK changelog identifies behavior changes across versions, including attribute-type handling. Preserve your lockfile and run representative targeting and assignment checks when upgrading. A matching experiment key alone does not establish that two different SDK versions and payloads make equivalent decisions.

Make caching and hydration part of the experiment

A shared cache that keys only on URL can return the first cached variant to users assigned elsewhere. You need a cache design that preserves the intended partition without leaking personalized content between users.

Cache-Control directives distinguish private responses and storage restrictions. The Vary header describes request header fields used to select a response. Neither is a substitute for checking the actual CDN and framework cache configuration. A variant cookie does not help if the relevant cache ignores it.

With server-rendered React, the initial browser render should match the server HTML. Hydration expects matching content; changing the assigned variant on the client can create mismatches as well as a compromised treatment. Pass only the public state the browser needs, preserve the initial decision, and test navigation and login transitions separately.

Verify SDK parity before wiring production delivery

Start with a local fixture and explicit prerequisites

The following fixture compares the Node shared-client API with the GrowthBook class used in browser integrations. It runs both inside Node against synthetic configuration. It does not render a page, contact GrowthBook, send analytics, or implement production identity.

Use a currently maintained Node.js release and an empty local directory. The callback context used below requires GrowthBook SDK 1.7.0 or later; this example pins version 2.0.0. Install the package, keep the lockfile, and inspect the resolved version before continuing:

npm init -y
npm install @growthbook/growthbook@2.0.0
npm ls @growthbook/growthbook

If installation fails, fix that prerequisite before running the fixture. Do not replace the SDK with a homemade hash and treat that as a check of the SDK's behavior. The browser JavaScript SDK documents the GrowthBook class, payload initialization, and tracking callback used here.

Save this as parity.mjs. The payload is an illustrative 50/50 experiment, not a production SDK connection or a CMS-created experiment:

import assert from "node:assert/strict";
import { GrowthBook, GrowthBookClient } from "@growthbook/growthbook";

const payload = {
  features: {
    "checkout-layout": {
      defaultValue: "baseline",
      rules: [{
        key: "checkout-layout-parity",
        seed: "checkout-layout-parity",
        hashAttribute: "id",
        hashVersion: 2,
        variations: ["baseline", "compact"],
        weights: [0.5, 0.5],
        coverage: 1,
      }],
    },
  },
};

const diagnostics = [];
const record = (side) => (experiment, result, user) => {
  diagnostics.push({
    side,
    experiment: experiment.key,
    variation: result.key,
    id: user?.attributes.id,
  });
};

const server = new GrowthBookClient({ trackingCallback: record("server") });
await server.init({ payload });

const seen = new Set();
for (let i = 1; i <= 100; i++) {
  const attributes = { id: `qa-user-${i}` };
  const scoped = server.createScopedInstance({ attributes });
  const serverValue = scoped.getFeatureValue("checkout-layout", "baseline");

  const browser = new GrowthBook({
    attributes,
    trackingCallback: record("browser"),
  });
  browser.initSync({ payload });
  const browserValue = browser.getFeatureValue("checkout-layout", "baseline");

  assert.equal(browserValue, serverValue);
  assert.equal(scoped.getFeatureValue("checkout-layout", "baseline"), serverValue);
  seen.add(serverValue);
  browser.destroy();
}

assert.equal(seen.size, 2);
assert.ok(diagnostics.length > 0);
assert.ok(diagnostics.every((d) => /^qa-user-\d+$/.test(d.id)));
console.log("PASS: matching values, repeatability, both branches, attributed diagnostics");
server.destroy();

The callback's objects are local diagnostic records defined by this example. They are not a transport contract, and putting an object in this array does not insert an exposure into your analytics system.

Run the check and interpret its limits

Use strict assertions to fail visibly when these invariants do not hold. Check syntax, then execute the file:

node --check parity.mjs
node parity.mjs

If the assertions pass, the script prints the PASS line. An import error means the dependency is missing or cannot be resolved. An assertion failure requires inspection of the installed SDK, payload, identifiers, and context; do not change an expected value simply to silence it.

The fixture checks equal values for these synthetic identifiers, repeatability within a scoped context, both values appearing, and identifier-shaped callback diagnostics. It does not establish a precise 50/50 sample split. It also does not prove request concurrency isolation, browser compatibility, actual rendering, or production identity correctness. Add those checks in your application's environment.

Replace the fixture boundary deliberately

For a real application, initialize configuration using the documented SDK connection and its failure-handling path. Supply identity from your application rather than the synthetic loop. Consume the selected value at the point that controls the treatment, then verify the response or UI actually follows it.

Browser integration additionally needs the application's module bundler or supported script integration, configuration readiness, and rendering lifecycle. A Node console run cannot verify those. If you use React, follow the React SDK integration rather than assuming the fixture provides a provider, hooks, or hydration handoff.

Finally, connect the documented callback or supported tracking integration to your real collection system. Map its experiment key, variation key, evaluation-time identity and timestamps to your agreed schema. Keep the mapping and retry behavior inspectable; do not copy the diagnostic array into a production event pipeline and assume attribution is complete.

Validate delivery and measurement before interpreting lift

Trace one unit through the entire path

For an isolated QA user, capture the input identifier, configuration version, selected value, delivered response, exposure record, and eventual outcome join. Repeat for both branches, a returning visitor, a login transition, and a missing-configuration fallback. Use a QA environment or isolated event sink so these checks do not create production experiment outcomes.

Test the real cache path. Make requests as different units, revisit the same unit, and inspect whether cache hits preserve the intended behavior. Test server-rendered content before JavaScript runs, after hydration, and after client-side navigation. A successful flag evaluation alongside the wrong UI is a failed experiment integration.

Include failure cases rather than only a successful page load. Delay configuration, drop the analytics request in an isolated test, and open an old tab after publishing a new QA payload. Check whether each case uses the intended fallback, keeps the correct identity, and leaves enough evidence to explain its inclusion or exclusion from analysis.

For a backend service, exercise overlapping requests from different QA users while inspecting the selected values and evaluation contexts. The sequential fixture above cannot reveal a race in your own middleware. For a browser, test a slow device and a failed script request, not just a fast development laptop. These checks target the actual ways a delivery path can diverge from its assignment record.

Write the expected failure behavior before running the checks. If an event does not arrive, the acceptable result is an observable gap with a documented handling rule, not a fabricated conversion or a silent reassignment. Keep operational recovery separate from any decision to change the experiment's analytical population.

Evaluate only where the value is relevant. GrowthBook's feature rule types distinguish targeted value delivery from an experiment rule. A percentage release is not automatically a measured A/B comparison, and a callback for a value that was never consumed does not demonstrate treatment exposure.

Reconcile collection instead of trusting one callback

Server assignment can reduce reliance on a browser for one event, but client outcomes can still be missing because of blockers, consent state, navigation, or transport failure. Server events can also fail through queues, retries, schema errors, or joins. Decide what is collected and eligible under your actual consent and measurement policy, then test that implementation symmetrically across arms.

Beacon-style analytics delivery can help with page transitions, but a successful enqueue is not proof of warehouse receipt. Reconcile callback or server logs with received events and the analyzed population. Preserve meaningful timestamps and define how duplicates are handled at the randomization unit.

Look for variant-specific loss. If treatment slows the page and its exposure is logged only after an animation completes, the retained treatment cohort can look unusually engaged. Moving assignment to the server does not repair that later selection. Record the relevant eligibility event consistently and inspect where users disappear between stages.

Consider a hypothetical collection audit with 1,000 known eligible QA units in each arm and 120 purchasers in each. Both full cohorts convert at 12%. Now suppose the exposure table retains only 900 control units and 980 treatment units, while retaining every purchaser. An analysis restricted to those recorded exposures reports 13.33% versus 12.24%. The apparent difference comes from the denominator loss, not the treatment.

In production, you cannot assume you know the missing units' outcomes as you do in this constructed example. That is why reconciliation starts with the eligibility and collection definitions, rather than repairing counts until a result looks plausible. Find the stage that lost records and assess whether the original comparison remains recoverable. More sophisticated statistics cannot restore an unidentified missing cohort.

Keep the analysis and rollback decision explicit

GrowthBook's data quality checks include sample ratio mismatch and multiple exposures. Use them alongside raw event reconciliation. Passing a traffic-split check does not prove every assigned user received the right treatment, and balanced counts do not reveal all symmetric instrumentation errors.

Before the experiment starts, record the primary metric, observation window, guardrails, sample-size or duration plan, statistical method, and decision rule. Server and client delivery do not have different laws of inference. A larger event count still does not replace independent users or accounts, and repeatedly checking a fixed-horizon result still needs an appropriate decision procedure.

If you migrate an existing experiment from browser to server delivery, document the handoff before combining results. A new identity source or exposure definition can change the analyzed population even when the product treatment appears identical. Preserve the old and new collection definitions, compare them in an isolated environment, and decide whether a separate phase or a new experiment is needed.

An A/A integration check can help uncover allocation, rendering, or telemetry differences when both arms deliver the same behavior. It does not prove the absence of bias because the result is nonsignificant. Combine that diagnostic with known QA users, raw event comparisons, and code review. Check that temporary parallel collection does not cause the same assignment or purchase to be counted twice after the handoff.

Assign an owner to the rollback path as well as the launch path. Verify which configuration change restores the intended default, how cached configuration updates, and what happens to users already assigned. After a decision, preserve the experiment record and remove obsolete branches through normal engineering review.

The architecture is ready when the unit, delivered experience, and measured outcome tell the same story. Choose the runtime that can implement the treatment faithfully, then make that full path reviewable before interpreting its lift.

Build a measurable release path

Connect your application, define the outcomes that matter, and review assignment and data quality before using an experiment result to guide a release.

Get Started With GrowthBook
Experiments

Quasi-experiments: types, examples, and limits

Nov 2, 2026
x
min read

A rollout can create useful evidence even when you cannot randomize users. The comparison still has to earn a causal interpretation.

Your team introduces a new onboarding process in one market because its support team is ready first. Activation improves. That is encouraging, but the market also received a new acquisition campaign. A before-and-after chart cannot tell you how much improvement came from onboarding, the campaign, or changes that would have happened anyway.

A quasi-experiment uses a nonrandom assignment process and an explicit comparison strategy to estimate an intervention's effect. The comparison might come from another market, an eligibility cutoff, a policy rule, or a carefully modeled historical pattern. Its credibility depends on why that comparison represents what would have happened without the intervention.

This guide organizes the main designs around those opportunities. You'll learn which rollout situations support each design, what effects they can estimate, and which assumptions remain vulnerable even when a result looks statistically precise.

Identify the assignment mechanism before choosing a design

Quasi-experimental is a family of approaches

Definitions differ across fields. Some researchers use the label broadly for intervention evaluations without random allocation. Others reserve it for designs that exploit plausibly external variation in treatment. The practical question is the same: what makes the treated and comparison outcomes informative about a counterfactual?

The official guidance on quasi-experimental product evaluation describes several approaches and emphasizes the difficulty of choosing a comparison group. A label alone does not resolve that difficulty. Comparing users who voluntarily adopt a feature with users who ignore it may primarily measure motivation, need, or product familiarity.

An uncontrolled before-and-after study is especially weak when trends or other changes can explain the difference. Some taxonomies call this pre-experimental; others include it among weaker quasi-experimental designs. Describe the actual comparison instead of letting terminology imply more protection than the study provides. Design improvements for non-equivalent groups and time series help make those differences visible.

Group and time assignment can still be randomized

An experiment does not become quasi-experimental because you assign organizations instead of individual people. Randomly allocating organizations produces a cluster-randomized experiment. Randomly allocating eligible time blocks can produce a randomized switchback design, although carryover and time dependence need attention.

Conversely, assigning regions according to commercial priorities remains nonrandom even if the regions have similar population sizes. “Geographic” describes the unit, not the identification strategy.

GrowthBook's cluster experiment workflow supports group-level randomization with appropriately configured individual-level outcomes. Before accepting that randomization is impossible, investigate whether a different unit or a narrower eligible population would make it feasible. That is a design decision, not a reason to pretend account-level assignment creates independent user-level observations.

Specify the effect before opening the results

Write down the intervention, eligible population, assignment unit, start time, outcome window, and effect you need. “Did onboarding work?” is too vague. “How did offering the new onboarding process affect 28-day activation among eligible accounts in the first rollout market?” identifies a clearer target.

Distinguish an offer from actual adoption. Adoption may depend on a user's motivation, which also affects activation. Restricting the analysis to adopters after launch can destroy the comparison you intended to study.

In a randomized implementation, experiment configuration makes the assignment attribute, hypothesis, and variation setup explicit. Carry the same discipline into a quasi-experimental protocol, while recognizing that documentation does not make a nonrandom assignment rule ignorable.

Use rollout timing to construct a credible comparison

Controlled before-and-after designs compare changes

Suppose a hypothetical product rollout changes 28-day activation as follows. The outcome definition and enrollment windows are the same in both markets.

MarketBefore rolloutAfter rolloutChange
First rollout market60%68%+8 percentage points
Comparison market58%62%+4 percentage points

The treated market improved by 8 points, but the comparison market improved by 4. A difference-in-differences calculation subtracts those changes: (68 - 60) - (62 - 58) = 4 percentage points.

The corresponding counterfactual for the treated market is 64%: its original 60% plus the comparison market's 4-point change. The estimated effect is 68% minus 64%. This is different from attributing the entire 8-point rise to the rollout.

The difference-in-differences identification argument requires that the groups' untreated outcomes would have followed parallel changes over the relevant period. Their baseline levels can differ. A simultaneous campaign confined to the rollout market threatens that argument because its effect enters the same 4-point estimate.

Inspect several pre-intervention periods and understand how rollout priority was chosen. A non-significant pretrend test does not prove the assumption; limited data may simply fail to reveal an important difference. Stable metric definitions and denominators are also necessary, since a new activation event or eligibility rule can manufacture an apparent change.

Staggered adoption needs explicit comparisons

When markets adopt in different months, “not treated yet” and “already treated” are different states. An already treated market can have an evolving treatment effect, making it an inappropriate stand-in for an untreated outcome.

Do not default to a single two-way fixed effects coefficient without understanding its comparisons. With heterogeneous or changing effects, it can mix effects that do not match the decision you want to make. Group-time treatment effect methods make treatment cohorts and comparison choices explicit.

For a product team, the operational task is to preserve adoption dates, eligibility, and untreated comparison periods before the rollout spreads. Once every market adopts, later effects may lack a credible untreated comparison. More post-rollout rows do not recreate that missing design element.

Interrupted time series uses the intervention date

An interrupted time series, or ITS, models the outcome trajectory before a known intervention and asks whether the subsequent level or slope departs from that trajectory. It is more informative than comparing two averages when a trend was already underway.

Consider a mandatory checkout change released everywhere on the same day. A daily series could assess an immediate discontinuity, a gradual slope change, or a delayed effect. Choose the expected pattern before searching for the most favorable model. The ITS tutorial and its updated materials address seasonality, autocorrelation, and concurrent events that complicate this analysis.

An interruption still needs a defensible counterfactual. If a holiday promotion begins on release day, an observed jump cannot distinguish the two changes without further information. An unaffected comparison series can strengthen the design when it shares relevant shocks, but a series touched by the same checkout change cannot serve that role.

Strengthen the design first

Review experiment-design mistakes, metric choices, and long-term impact in this session with Ronny Kohavi and Luke Sonnet before committing to a rollout comparison.

Explore Experiment Design

Use cutoffs and external rules without overstating their reach

Regression discontinuity identifies effects near a threshold

A regression discontinuity design, or RDD, can be useful when a pre-existing numerical rule determines eligibility. Imagine a hypothetical service offering proactive onboarding support to accounts with a risk score of at least 70. Accounts just above and below 70 may provide a useful local comparison if other determinants of activation change smoothly at the threshold.

The local cutoff identification argument does not require all high-risk and low-risk accounts to be comparable. It concerns the limit near the cutoff. The resulting effect should not automatically be generalized to accounts with scores of 20 or 95.

Check whether teams can manipulate the score or override eligibility. Also check whether the threshold triggers another intervention, such as a pricing change. If several benefits change at 70, the design may identify the effect of that bundle rather than onboarding support alone.

Implementation requires a defensible neighborhood and functional form. A raw difference between broad score bands is not the same as estimating a discontinuity. Local polynomial RD tools provide estimation, bandwidth selection, plotting, and bias-corrected inference; they cannot establish that the eligibility rule was uncompromised.

Fuzzy eligibility changes treatment probability

In a sharp design, the threshold determines treatment. In a fuzzy design, it changes the probability of treatment because some eligible accounts decline support or some ineligible accounts receive an exception.

Suppose, purely as a numerical illustration, fitted adoption probability jumps from 20% to 80% at the cutoff while fitted activation jumps from 63% to 69%. The ratio is 0.06 / 0.60 = 0.10, or 10 percentage points. Interpreting that ratio as a treatment effect requires additional instrumental-variable assumptions, including that eligibility affects activation only through the treatment and that treatment uptake moves in the required direction.

Those assumptions matter more than the attractive arithmetic. The effect concerns accounts whose treatment changes because of eligibility near the threshold. It is not automatically the effect for every account that used support.

Natural experiments need an assignment story

A natural experiment exploits an externally determined event or rule that generates useful treatment variation. The event is not necessarily a literal disaster or a sudden policy change. What matters is why its assignment is plausibly unrelated to the otherwise expected outcome, within the proposed comparison.

An instrumental-variable design can use such variation to study adoption. But an instrument must affect treatment, be suitably independent of outcome determinants, and satisfy an exclusion argument. Instrumental-variable assumptions and local effects explain why a predictor of adoption is not automatically a valid instrument.

For example, a support-team capacity rule may change whether an account receives onboarding. If that capacity also changes response times for unrelated support requests, the rule can affect activation through another path. Calling the variation external does not remove that problem. Preserve the operational records needed to examine those paths before staff assignments or exceptions are forgotten.

Construct comparison groups without hiding selection

Synthetic controls combine untreated units

When one market receives an intervention, a synthetic control can combine other markets into a weighted comparison chosen to resemble its pre-intervention trajectory and relevant predictors. It can be useful when no single market is a convincing comparison.

In a hypothetical illustration, weights of 60% and 40% on donor outcomes of 24 and 29 produce a synthetic outcome of 26. If the treated outcome is 30, the post-intervention gap is 4 outcome units. That gap becomes a causal estimate only if the donor construction and counterfactual assumptions are credible.

The feasibility requirements for synthetic controls include the availability of suitable donors and informative pre-intervention data. Donors affected by the intervention, related campaigns, or spillovers can contaminate the comparison. Good historical fit is useful evidence, but it does not guarantee that the treated market avoided a unique post-intervention shock.

Choose donors and fitting decisions without optimizing the desired post-intervention result. Compare alternative defensible donor pools and examine placebo analyses, while recognizing that a small, unusual donor set limits what those comparisons can establish.

Matching and weighting depend on measured information

Matching can align treated and comparison accounts on recorded characteristics. Weighting can reweight observations toward a specified population. These approaches may improve a non-equivalent-group design, but balance on available columns does not establish balance on unmeasured intent or readiness.

The unconfoundedness and overlap requirements are central to causal interpretations based on measured adjustment. If every enterprise account receives onboarding and no comparable enterprise account goes untreated, a model may be extrapolating rather than making a supported comparison.

Use pre-treatment variables appropriate to the causal question. Do not adjust for completed onboarding steps when those steps are part of how the intervention changes activation. That can remove part of the effect or introduce selection bias. Treat the choice of adjustment variables as a design decision, not an automatic instruction to include every warehouse field.

Let the assignment process narrow the candidates

Available variationCandidate designMain question to resolve
Some markets change while others remain untreatedControlled before-and-after or DiDWould untreated outcomes have changed similarly?
A known date interrupts a sufficiently informative seriesITS, preferably with a suitable control seriesCould another event or trend explain the interruption?
Eligibility changes at a numerical thresholdSharp or fuzzy RDDAre potential outcomes continuous and the rule unmanipulated?
An external rule changes treatment uptakeNatural experiment or IVDoes the rule affect the outcome through another path?
One treated unit has suitable unaffected donorsSynthetic controlCan the donors support a credible post-intervention counterfactual?

If none of these arguments fits, a descriptive comparison may still be useful. Report it as descriptive rather than converting it into a causal claim through a more complicated model.

Audit threats that precise estimates can conceal

Keep population and exposure definitions stable

An activation rate can rise because activation improved or because the analyzed accounts changed. Record who was eligible at each date, who entered the data, and how incomplete outcome windows were handled. A later cohort with only 7 days of follow-up should not be compared with an earlier cohort's completed 28-day outcome.

Differential attrition creates another problem. If the intervention changes whether accounts remain observable, complete-case analysis can compare selected survivors. Similarly, filtering to users who revisit can condition on behavior caused by treatment. Count definitions and exclusions should follow the question, not the apparent direction of the result.

Also distinguish assigned availability from actual exposure. A rollout date does not mean every account encountered the new process that day. A per-protocol question about adoption needs its own assumptions; it cannot quietly replace an offer-based question after the analysis begins.

Trace spillovers, anticipation, and shared shocks

Markets can affect one another through referrals, shared sales teams, supply constraints, or users crossing boundaries. An untreated region may therefore receive part of the treatment's effect. A comparison that is administratively untreated is not necessarily causally unaffected.

People may also change behavior before the official launch because of an announcement or training. Decide whether the treatment includes that anticipation period and adjust the protocol accordingly. The date in the release calendar may be too late to define the intervention's true start.

For randomized work, GrowthBook's data quality checks surface issues such as sample ratio mismatch and multiple exposures. Those checks support an experiment's data review; they do not test the parallel trends, exclusion, or continuity assumptions of a quasi-experiment.

Match uncertainty to the source of variation

Thousands of user rows from one treated region do not create thousands of independently treated regions. Shared regional shocks and repeated measurements can make row-level standard errors misleading. The inference method needs to reflect the unit and time structure that generate the treatment comparison.

Few treated or comparison units are particularly challenging. Cluster-robust calculations, resampling, or placebo procedures have design-specific requirements; none creates independent information that was absent from the rollout. Report those limits alongside the interval instead of hiding them behind a large event count.

A falsification check should challenge a particular explanation. For example, a rollout should not change an outcome measured before any announcement or exposure. An apparent effect there can reveal a timing problem, selection, or model failure. A negative-control outcome can be useful when it shares the suspected confounding process but cannot plausibly respond to treatment. The logic of falsification testing helps distinguish that exercise from simply adding more favorable outcome charts.

Passing a check is weaker evidence than failing a well-chosen one. An unaffected outcome may not share the relevant confounder, and a placebo test may have little power. Explain why the check would reveal the threat you care about, rather than treating a collection of non-significant tests as certification.

Statistical precision also addresses a different question from identification. A narrow interval under a misspecified counterfactual can be precisely wrong. The interpretation of experiment results should keep uncertainty and data quality visible, while a quasi-experimental review must additionally evaluate the assumptions creating its comparison.

Write a protocol that can survive the rollout review

Record the causal argument before estimating the effect

A useful protocol begins with a decision: what rollout choice will this evidence inform, and what magnitude would matter? Then state the treatment version, target population, assignment mechanism, counterfactual, outcome scale, observation window, and primary analysis.

Add a threat-specific diagnostic plan. For a cutoff, inspect the assignment rule, score distribution, and other changes at the threshold. For a timed rollout, investigate pretrends, announcements, concurrent campaigns, and comparison-group exposure. Choose checks because they challenge the causal argument, not because they are easy to pass.

State what would change the conclusion. A missing historical period, an unexplained composition break, or a coincident market-specific campaign might downgrade the analysis to descriptive evidence. This makes the review useful even when the preferred causal interpretation fails.

Preserve operational evidence while the rollout is happening. Keep the original eligibility rule, announcement and deployment dates, exception log, support-capacity changes, and a record of campaigns affecting each comparison unit. Save the version of the score used for cutoff assignment rather than a later score updated after treatment. Historical outcomes alone cannot reconstruct those decisions reliably.

For the onboarding example, an audit-ready record might say: the offer began on a specified date; eligibility used account status recorded beforehand; accounts received a completed 28-day window; the comparison market retained its original process; and the concurrent campaign was either separately identified or acknowledged as unresolved. Each statement answers a concrete design question. A table containing only account IDs, a treatment flag, and activation cannot answer them all.

Report the scope and alternatives with the estimate

Share the estimate with its units, uncertainty, target population, comparison, and identifying assumptions. Separate prespecified analyses from sensitivity checks and later exploration. A result near an eligibility cutoff, an effect on treated markets, and an effect for instrument-induced adopters are different answers.

When several defensible specifications agree, explain what they share. Agreement is less reassuring if every specification assumes away the same unmeasured campaign. When results differ, show which assumption, window, or population change drives the difference rather than selecting the most favorable estimate.

Keep transport to the next rollout separate from identification of the first effect. A result for accounts near a risk threshold may not predict what happens when support is offered to everyone. Wider deployment can change staff capacity, user composition, or interactions between accounts. Even a credible local estimate may therefore support a staged follow-up rather than a universal rollout decision.

Treat that limitation as useful information for planning. Name which accounts and operational conditions the evidence covers, which extension is uncertain, and what additional comparison would reduce that uncertainty. This gives the next experiment a specific job instead of repeating the same broad question with another model.

Preserve opportunities for randomized evidence

Operational constraints may leave room for a randomized subpopulation, cluster assignment, or delayed release. A planned A/B design can sometimes answer a narrower question more credibly than a broad observational comparison. For long-term cumulative release questions, holdouts preserve a baseline across an explicitly defined feature scope.

GrowthBook's experiment decision framework helps connect randomized experiment evidence to success criteria and target precision. Its experimentation platform also supports reusable warehouse metrics and visible SQL. Those foundations help teams maintain consistent measurement; they do not turn a nonrandom rollout into a randomized study or supply a native estimator for every quasi-experimental design.

Choose the strongest comparison your assignment process can justify. Then make the limits clear enough that the next person reviewing the rollout can tell what the evidence supports and what still requires another study.

Build the randomized comparison

When your rollout allows random assignment, use GrowthBook to connect the experiment to explicit warehouse metrics and a reviewable decision process.

Get Started With GrowthBook

Ready to ship faster?

No credit card required. Start with feature flags, experimentation, and product analytics—free.

Simplified white illustration of a right angle ruler or carpenter's square tool.White checkmark symbol with a scattered pixelated effect around its edges on a transparent background.