Skip to main content
Some tools are connected once for the whole workspace and then given to agents one at a time. Today that is Langfuse. Slack, Linear and GitHub are set up on each agent instead, because each agent has its own identity there. For how the keys are kept and where they go, see If you connect a tool.

​
Before you start

An admin, to connect it

Only an owner or admin can connect, edit, rotate or remove a tool.

A department lead, to give it

A department lead or above gives it to the agents they lead.

The agent in the box, on a current runner

Runner 0.2.23 or later, which the desktop app installs by updating itself. An older runner is never sent a connected tool’s keys, and the agent says so.

Keys made for the agents

A key reaches everything its tool lets it. Make one for the agents rather than reusing a person’s.

​
Connect Langfuse

1

Make a key in Langfuse

In Langfuse, open the project the agents should use, then its settings, API Keys, and create a new key pair. Keep the window open: the secret key is shown only once.
2

Open Langfuse in Agentick

In the sidebar, Integrations → Langfuse → Connect (Add connection once there is one).
3

Fill in the form

  • Name: how people and agents tell it apart, such as Langfuse – prod. Agents see it in their instructions.
  • Public key: starts with pk-lf-.
  • Secret key: starts with sk-lf-. It is encrypted when you connect and is never shown again, to anyone.
  • Base URL: your Langfuse region, such as https://us.cloud.langfuse.com, or your own Langfuse. It must be https://.
4

Connect

The connection appears under Connections on the Langfuse page, with no agent yet. A key in the wrong form is refused with the field named.
You can connect several Langfuse projects, one connection each.

​
Give it to an agent

Either from the connection’s page, under Agents with access, or from the agent:
  1. Open the agent, then its Tools tab.
  2. Under Workspace tools it could have, set the connection to On.
The agent’s next piece of work has it. It runs the Langfuse command-line tool, langfuse, which is already in its box, and its instructions name the project. Set it back to Off and its next piece of work has no key.
A Langfuse key has no read-only scope. On is full access to that project: the agent can read and change anything there. See Known gaps.

​
Rotate, edit or remove it

On the connection’s page (Integrations → Langfuse → the connection):
  • Rotate takes a new secret key. The old one is gone the moment you save; revoke it in Langfuse too.
  • Edit renames it or changes its plain fields. The secret changes only by rotating.
  • Remove destroys its stored secret and takes it from every agent at once. Its name stays on record for your audit log.
Every change is in your audit log, with who made it, never a value.

​
If the agent cannot reach it

  • The agent says it was not given the key. Its runner is older than 0.2.23, or still finishing an update. Restart the Agentick app on that Mac to let it update, then ask again.
  • The agent gets a network error. Under the Strict network setting, the connection’s address is allowed only while a step holding its key runs. Check that the Base URL is the address your Langfuse answers on.
  • Langfuse refuses the key. Rotate it with a key that works in Langfuse itself.