Langfuse

Stream Ingate's gateway traces into Langfuse over OTLP, authenticated with your project's public/secret key pair.

What it is

Langfuse is an open-source LLM engineering platform (tracing, prompt management, and evals) that accepts traces over a standard OTLP endpoint, authenticated with HTTP Basic auth built from a project's public/secret key pair.

Consume traces from Ingate

Create an export config pointing at Langfuse's OTLP traces endpoint, with your project keys base64-encoded into a Basic auth header:

bash
curl -X POST https://api.ingateai.com/api/v1/exports \
  -H "X-Ingate-Key: sk-ingate-..." \
  -H "Content-Type: application/json" \
  -d '{
    "name": "langfuse",
    "kind": "otlp",
    "endpoint": "https://cloud.langfuse.com/api/public/otel/v1/traces",
    "headers": {"Authorization": "Basic <base64 pk:sk>"},
    "include_sources": ["proxy", "api"]
  }'

<base64 pk:sk> is your Langfuse public and secret key joined with : and base64-encoded (echo -n "pk-lf-...:sk-lf-..." | base64), the same credential Langfuse's own OTLP docs describe. Self-hosting Langfuse instead of using Langfuse Cloud just means a different endpoint host.

Header secrecy

headers (including this Authorization value) is encrypted at rest the same way provider API keys are, and, like every export config's headers and secret fields, is never returned by any GET/PUT response; GET /api/v1/exports/:id shows only has_secret, not the header contents. If you need to rotate the key pair, PUT a new headers value rather than trying to read the old one back.

Spans arrive as OTLP application/x-protobuf, batched, using OTel GenAI semantic conventions, the same attribute vocabulary Langfuse's own OTel instrumentation produces, so Ingate-proxied calls show up in Langfuse's trace view next to traces from any other GenAI-OTel source.

Reference

  • Trace Exports: how gateway trace streaming works
  • Exports API: full config shape, encryption details, include_sources semantics
Previous
Promptfoo
Next
Arize Phoenix