Skip to main content
Connect your Langfuse project to enable CloudThinker agents to investigate LLM traces, debug conversations, review evaluation scores and datasets, and audit prompt versions across your observability stack. Langfuse authenticates with a project-scoped API key pair (a public key and a secret key) against your Langfuse host โ€” the same setup works for Langfuse Cloud and self-hosted instances.

โ€‹
Prerequisites

  • A Langfuse Cloud or self-hosted project you want to investigate.
  • A project-scoped API key pair (public key and secret key) from that project.
  • Your Langfuse host URL (https://cloud.langfuse.com for EU, https://us.cloud.langfuse.com for US, or your self-hosted domain).
Langfuse API keys are scoped to a single project. Create the key pair in the project CloudThinker should reach, and use a key pair dedicated to CloudThinker so access is easy to audit and revoke.

โ€‹
Setup

1

Open Langfuse

Sign in to Langfuse and select the project you want CloudThinker to investigate.
2

Create an API key pair

Go to Project โ†’ Settings โ†’ API Keys and click Create new API keys. Langfuse generates:
  • A Public Key (prefixed pk-lf-)
  • A Secret Key (prefixed sk-lf-)
Copy the secret key immediately โ€” it is shown only once and cannot be retrieved later.
3

Add connection in CloudThinker

Navigate to Connections โ†’ Langfuse and enter:
  • Host: your Langfuse base URL, e.g. https://cloud.langfuse.com (base URL only, no path)
  • Public Key: the pk-lf- key you created
  • Secret Key: the sk-lf- key you created
Click Connect. CloudThinker verifies the credentials and shows a Connected status.
Copy the secret key immediately after creation. Langfuse shows it only once, so youโ€™ll need to create a new key pair if itโ€™s lost.

โ€‹
Connection details

FieldDescriptionExample
LANGFUSE_HOSTBase URL of your Langfuse instance โ€” EU cloud, US cloud, or self-hostedhttps://cloud.langfuse.com
LANGFUSE_PUBLIC_KEYProject-scoped public keypk-lf-...
LANGFUSE_SECRET_KEYProject-scoped secret keysk-lf-...

โ€‹
Required permissions

Langfuse API keys inherit the access of the project they belong to. CloudThinker uses the key pair for read and investigation workflows across traces, observations, metrics, scores, datasets, annotation queues, comments, and prompts.
Follow least privilege: scope the key pair to the single project CloudThinker should investigate, and keep it separate from keys used by your SDKs or other integrations so it can be rotated or revoked independently.

โ€‹
Agent capabilities

Once connected, agents can investigate LLM observability data across your Langfuse project.
CapabilityDescription
TracesSearch and inspect traces, correlate errors, latency, and model usage
ObservationsDrill into spans, generations, and events within a trace
MetricsQuery usage, latency, and cost metrics over a time window
ScoresReview evaluation scores and quality signals
DatasetsInspect datasets used for evaluation and testing
Annotation queuesReview annotation queues and their items
CommentsRead comments left on traces and observations
PromptsList prompt versions, labels, and recent changes for prompt audits
A CloudThinker chat URL carries a conversationId that maps to a Langfuse sessionId. Ask the agent to analyze the chat URL and it resolves the session through Langfuse rather than fetching the URL as a webpage.

โ€‹
Verify the connection

@alex investigate recent Langfuse traces and summarize errors, latency, and model usage

โ€‹
Example prompts

@alex investigate recent failed Langfuse traces for production conversations, correlate errors and latency, and #recommend likely fixes
@alex inspect this CloudThinker chat URL by mapping its conversationId to a Langfuse session and summarize tool calls, model usage, and failures
@alex list active Langfuse prompts, versions, and labels, and #report prompts tied to degraded scores
Trace and metric queries are time-bounded, so mention a window (e.g. โ€œthe last hourโ€) to keep results focused.

โ€‹
Troubleshooting

Verify the public and secret keys are correct and have not been rotated or deleted. Confirm both keys belong to the same Langfuse project and were copied without extra whitespace.
Data is separated per region, so a key pair only works against the host it was created in. Check that LANGFUSE_HOST matches the URL you sign in to, e.g. https://cloud.langfuse.com for EU or https://us.cloud.langfuse.com for US.
LANGFUSE_HOST has an extra path suffix. Set it to the base URL only, with no trailing path.
Trace and metric searches need a time range. Ask the agent to use a recent window (e.g. the last hour) and widen it only if needed. Confirm the project is actively receiving traces from your application.
Ask the agent to extract the conversationId and map it to a Langfuse sessionId instead of fetching the URL directly.

โ€‹
Security

  • Least privilege โ€” grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default โ€” use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials โ€” rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding โ€” remove the credential at the provider when you delete a connection or a teammate leaves.
  • Project-scoped key pair โ€” use a key pair scoped to the single project CloudThinker investigates; create a dedicated pair for CloudThinker so access is easy to audit and revoke independently.
  • Correct host โ€” match the host to the region where the project lives to avoid cross-region failures.
https://mintcdn.com/cloudthinker/CGWam0VVP8R5KVLk/images/icons/signoz.svg?fit=max&auto=format&n=CGWam0VVP8R5KVLk&q=85&s=d08abadb07adcc41c8812b59483344e3

SigNoz Connection

Logs, metrics, traces, and dashboards
https://mintcdn.com/cloudthinker/aLd-ttc-SCW-aFky/images/icons/datadog.svg?fit=max&auto=format&n=aLd-ttc-SCW-aFky&q=85&s=e8382167f2a1eb1e00971b5f4d703d48

Datadog Connection

Log search, metrics, and monitoring