> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agentick.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect a tool

> Connect a tool once for the workspace, then choose which agents may use it.

Some tools are connected once for the whole workspace and then given to agents
one at a time. Today that is **Langfuse**. Slack, Linear and GitHub are set up
on each agent instead, because each agent has its own identity there.

For how the keys are kept and where they go, see
[If you connect a tool](/trust/where-things-run#if-you-connect-a-tool).

## Before you start

<CardGroup cols={2}>
  <Card title="An admin, to connect it" icon="user-shield">
    Only an owner or admin can connect, edit, rotate or remove a tool.
  </Card>

  <Card title="A department lead, to give it" icon="users">
    A department lead or above gives it to the agents they lead.
  </Card>

  <Card title="The agent in the box, on a current runner" icon="box">
    Runner 0.2.23 or later, which the desktop app installs by updating itself.
    An older runner is never sent a connected tool's keys, and the agent says
    so.
  </Card>

  <Card title="Keys made for the agents" icon="key">
    A key reaches everything its tool lets it. Make one for the agents rather
    than reusing a person's.
  </Card>
</CardGroup>

## Connect Langfuse

<Steps>
  <Step title="Make a key in Langfuse">
    In Langfuse, open the project the agents should use, then its settings,
    **API Keys**, and create a new key pair. Keep the window open: the secret
    key is shown only once.
  </Step>

  <Step title="Open Langfuse in Agentick">
    In the sidebar, **Integrations → Langfuse → Connect** (**Add connection**
    once there is one).
  </Step>

  <Step title="Fill in the form">
    * **Name**: how people and agents tell it apart, such as `Langfuse – prod`.
      Agents see it in their instructions.
    * **Public key**: starts with `pk-lf-`.
    * **Secret key**: starts with `sk-lf-`. It is encrypted when you connect
      and is never shown again, to anyone.
    * **Base URL**: your Langfuse region, such as
      `https://us.cloud.langfuse.com`, or your own Langfuse. It must be
      `https://`.
  </Step>

  <Step title="Connect">
    The connection appears under **Connections** on the Langfuse page, with
    no agent yet. A key in the wrong form is refused with the field named.
  </Step>
</Steps>

You can connect several Langfuse projects, one connection each.

## Give it to an agent

Either from the connection's page, under **Agents with access**, or from the
agent:

1. Open the agent, then its **Tools** tab.
2. Under **Workspace tools it could have**, set the connection to **On**.

The agent's next piece of work has it. It runs the Langfuse command-line tool,
`langfuse`, which is already in its box, and its instructions name the
project. Set it back to **Off** and its next piece of work has no key.

<Warning>
  A Langfuse key has no read-only scope. **On** is full access to that project:
  the agent can read and change anything there. See
  [Known gaps](/trust/known-gaps#connected-tools-keys-reach-everything-their-tool-allows).
</Warning>

## Rotate, edit or remove it

On the connection's page (**Integrations → Langfuse →** the connection):

* **Rotate** takes a new secret key. The old one is gone the moment you save;
  revoke it in Langfuse too.
* **Edit** renames it or changes its plain fields. The secret changes only by
  rotating.
* **Remove** destroys its stored secret and takes it from every agent at once.
  Its name stays on record for your audit log.

Every change is in your audit log, with who made it, never a value.

## If the agent cannot reach it

* **The agent says it was not given the key.** Its runner is older than
  0.2.23, or still finishing an update. Restart the Agentick app on that Mac to
  let it update, then ask again.
* **The agent gets a network error.** Under the **Strict** network setting, the
  connection's address is allowed only while a step holding its key runs. Check
  that the **Base URL** is the address your Langfuse answers on.
* **Langfuse refuses the key.** Rotate it with a key that works in Langfuse
  itself.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.