Centralized API Key Management with Secret Store Integration (e.g. HashiCorp Vault)

[bikram42]

Describe the feature or potential improvement

I have been an enthusiastic user of Langfuse since its inception and greatly appreciate the robust features it offers. I would like to suggest an enhancement that could further streamline the development process: integrating centralized API key management for various LLM providers within Langfuse.

By incorporating support for secret management tools such as HashiCorp Vault, developers could securely store and manage their API keys directly through Langfuse. This integration would allow for seamless retrieval of keys via the SDK or API, enhancing both security and efficiency.

I believe this feature would be a valuable addition to Langfuse’s capabilities and would significantly benefit the developer community.

Additional information

No response

[marcklingen]

Thanks for sharing. Currently, the keys are symmetrically encrypted and stored in the Postgres database. I agree that moving them to a solution like HashiCorp Vault would improve the current setup, but it might introduce challenges in self-hosting Langfuse.

Let's track overall interest for this here.

[bikram42]

@marcklingen currently can we store API keys (OpenAI, Gemini, etc) in the postgres database using langfuse?

[marcklingen]

Yes, see above and Langfuse Documentation.

Generally, most LLM secrets do not need to be in Langfuse. If you use Langfuse for tracing and observability, the LLM calls are captured at the application level, which means Langfuse does not need access to the secrets.