.env.prod.example

# More information: https://langfuse.com/docs/deployment/self-host

# When adding additional environment variables, the schema in "/src/env.mjs"
# should be updated accordingly.

# Prisma
# https://www.prisma.io/docs/reference/database-reference/connection-urls#env
# DATABASE_URL supports pooled connections, but then you need to set DIRECT_URL
DATABASE_URL="postgresql://postgres:postgres@postgres:5432/postgres"
# DIRECT_URL="postgresql://postgres:postgres@postgres:5432/postgres"
# SHADOW_DATABASE_URL=
# optional, set to true to disable automated database migrations on Docker start
# LANGFUSE_AUTO_POSTGRES_MIGRATION_DISABLED=
# optional, set to true to disable the automated GreptimeDB schema migration on Docker start
# (web + standalone entrypoints; idempotent + advisory-lock serialised). Run it by hand with
# `pnpm --filter=@langfuse/shared run greptime:migrate` if you disable it here.
# LANGFUSE_AUTO_GREPTIME_MIGRATION_DISABLED=

# Next Auth
# NEXTAUTH_URL does not need to be set when deploying on Vercel
NEXTAUTH_URL="http://localhost:3000"

# For each of these, you can generate a new secret on the command line with:
# openssl rand -base64 32
NEXTAUTH_SECRET="secret" # https://next-auth.js.org/configuration/options#secret
SALT="salt" # salt used to hash api keys

# API level encryption for sensitive data
# Must be 256 bits, 64 string characters in hex format, generate via: openssl rand -hex 32
ENCRYPTION_KEY="0000000000000000000000000000000000000000000000000000000000000000"

# Use CSP headers to enforce HTTPS, optional
# LANGFUSE_CSP_ENFORCE_HTTPS="true"

# Configure base path for self-hosting, optional
# Note: You need to build the docker image with the base path set and cannot use the pre-built docker image if you set this.
# NEXT_PUBLIC_BASE_PATH="/app"

# Docker only, optional
# PORT=3000
# HOSTNAME=localhost

# Opentelemetry, optional
OTEL_EXPORTER_OTLP_ENDPOINT="http://localhost:4318"
OTEL_SERVICE_NAME="langfuse"

# Default role for users who sign up, optional, can be org or org+project
# Supports comma-separated IDs for multiple orgs (e.g., "org1,org2,org3")
# LANGFUSE_DEFAULT_ORG_ID=
# LANGFUSE_DEFAULT_ORG_ROLE=
# Supports comma-separated IDs for multiple projects (e.g., "proj1,proj2,proj3")
# LANGFUSE_DEFAULT_PROJECT_ID=
# LANGFUSE_DEFAULT_PROJECT_ROLE=

# Logging, optional
# LANGFUSE_LOG_LEVEL=info
# LANGFUSE_LOG_FORMAT=text

# Enable experimental features, optional
# LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES=false
# LANGFUSE_ENABLE_WEB_CALLOUTS=false

# Auth, optional configuration
# AUTH_DOMAINS_WITH_SSO_ENFORCEMENT=domain1.com,domain2.com
# AUTH_IGNORE_ACCOUNT_FIELDS=foo,bar
# AUTH_DISABLE_USERNAME_PASSWORD=true
# AUTH_DISABLE_SIGNUP=true
# AUTH_SESSION_MAX_AGE=43200 # 30 days in minutes (default)

# SSO, each group is optional
# AUTH_GOOGLE_CLIENT_ID=
# AUTH_GOOGLE_CLIENT_SECRET=
# AUTH_GOOGLE_ALLOW_ACCOUNT_LINKING=false
# AUTH_GOOGLE_ALLOWED_DOMAINS=langfuse.com,google.com # optional allowlist of workspace domains that can sign in via Google
# AUTH_GOOGLE_CLIENT_AUTH_METHOD=
# AUTH_GOOGLE_CHECKS=
# AUTH_GOOGLE_ID_TOKEN_SIGNED_RESPONSE_ALG=
# AUTH_GITHUB_CLIENT_ID=
# AUTH_GITHUB_CLIENT_SECRET=
# AUTH_GITHUB_ALLOW_ACCOUNT_LINKING=false
# AUTH_GITHUB_CLIENT_AUTH_METHOD=
# AUTH_GITHUB_CHECKS=
# AUTH_GITHUB_ENTERPRISE_CLIENT_ID=
# AUTH_GITHUB_ENTERPRISE_CLIENT_SECRET=
# AUTH_GITHUB_ENTERPRISE_BASE_URL=
# AUTH_GITHUB_ENTERPRISE_ALLOW_ACCOUNT_LINKING=false
# AUTH_GITHUB_ENTERPRISE_CLIENT_AUTH_METHOD=
# AUTH_GITHUB_ENTERPRISE_CHECKS=
# AUTH_GITLAB_CLIENT_ID=
# AUTH_GITLAB_CLIENT_SECRET=
# AUTH_GITLAB_ALLOW_ACCOUNT_LINKING=false
# AUTH_GITLAB_ISSUER=
# AUTH_GITLAB_CLIENT_AUTH_METHOD=
# AUTH_GITLAB_CHECKS=
# AUTH_GITLAB_ID_TOKEN_SIGNED_RESPONSE_ALG=
# AUTH_GITLAB_URL=
# AUTH_AZURE_AD_CLIENT_ID=
# AUTH_AZURE_AD_CLIENT_SECRET=
# AUTH_AZURE_AD_TENANT_ID=
# AUTH_AZURE_AD_ALLOW_ACCOUNT_LINKING=false
# AUTH_AZURE_AD_CLIENT_AUTH_METHOD=
# AUTH_AZURE_AD_CHECKS=
# AUTH_AZURE_AD_ID_TOKEN_SIGNED_RESPONSE_ALG=
# AUTH_OKTA_CLIENT_ID=
# AUTH_OKTA_CLIENT_SECRET=
# AUTH_OKTA_ISSUER=
# AUTH_OKTA_ALLOW_ACCOUNT_LINKING=false
# AUTH_OKTA_CLIENT_AUTH_METHOD=
# AUTH_OKTA_CHECKS=
# AUTH_OKTA_ID_TOKEN_SIGNED_RESPONSE_ALG=
# AUTH_AUTH0_CLIENT_ID=
# AUTH_AUTH0_CLIENT_SECRET=
# AUTH_AUTH0_ISSUER=
# AUTH_AUTH0_ALLOW_ACCOUNT_LINKING=false
# AUTH_AUTH0_CLIENT_AUTH_METHOD=
# AUTH_AUTH0_CHECKS=
# AUTH_AUTH0_ID_TOKEN_SIGNED_RESPONSE_ALG=
# AUTH_COGNITO_CLIENT_ID=
# AUTH_COGNITO_CLIENT_SECRET=
# AUTH_COGNITO_ISSUER=
# AUTH_COGNITO_ALLOW_ACCOUNT_LINKING=false
# AUTH_COGNITO_CLIENT_AUTH_METHOD=
# AUTH_COGNITO_CHECKS=
# AUTH_COGNITO_ID_TOKEN_SIGNED_RESPONSE_ALG=
# AUTH_KEYCLOAK_CLIENT_ID=
# AUTH_KEYCLOAK_CLIENT_SECRET=
# AUTH_KEYCLOAK_ISSUER=
# AUTH_KEYCLOAK_ALLOW_ACCOUNT_LINKING=false
# AUTH_KEYCLOAK_CLIENT_AUTH_METHOD=
# AUTH_KEYCLOAK_CHECKS=
# AUTH_KEYCLOAK_ID_TOKEN_SIGNED_RESPONSE_ALG=
# AUTH_KEYCLOAK_NAME=
# AUTH_WORKOS_CLIENT_ID=
# AUTH_WORKOS_CLIENT_SECRET=
# AUTH_WORKOS_ALLOW_ACCOUNT_LINKING=false
# AUTH_WORKOS_ORGANIZATION_ID=
# AUTH_WORKOS_CONNECTION_ID=
# AUTH_CUSTOM_CLIENT_ID=
# AUTH_CUSTOM_CLIENT_SECRET=
# AUTH_CUSTOM_ISSUER=
# AUTH_CUSTOM_NAME=
# AUTH_CUSTOM_SCOPE="openid email profile" # optional
# AUTH_CUSTOM_CLIENT_AUTH_METHOD="client_secret_basic" # optional
# AUTH_CUSTOM_ALLOW_ACCOUNT_LINKING=false
# AUTH_CUSTOM_ID_TOKEN=false # optional, default is true
# AUTH_CUSTOM_CLIENT_AUTH_METHOD=
# AUTH_CUSTOM_CHECKS=
# AUTH_CUSTOM_ID_TOKEN_SIGNED_RESPONSE_ALG=
# AUTH_JUMPCLOUD_CLIENT_ID=
# AUTH_JUMPCLOUD_CLIENT_SECRET=
# AUTH_JUMPCLOUD_ISSUER=
# AUTH_JUMPCLOUD_ALLOW_ACCOUNT_LINKING=
# AUTH_JUMPCLOUD_CLIENT_AUTH_METHOD=
# AUTH_JUMPCLOUD_CHECKS=
# AUTH_JUMPCLOUD_ID_TOKEN_SIGNED_RESPONSE_ALG=
# AUTH_JUMPCLOUD_SCOPE=

# Transactional email, optional
# Defines the email address to use as the from address.
# EMAIL_FROM_ADDRESS=
# Defines the connection url for smtp server.
# SMTP_CONNECTION_URL=

# S3 Batch Exports
# LANGFUSE_S3_BATCH_EXPORT_ENABLED=
# LANGFUSE_S3_BATCH_EXPORT_BUCKET=
# LANGFUSE_S3_BATCH_EXPORT_ACCESS_KEY_ID=
# LANGFUSE_S3_BATCH_EXPORT_SECRET_ACCESS_KEY=
# LANGFUSE_S3_BATCH_EXPORT_REGION=
# LANGFUSE_S3_BATCH_EXPORT_ENDPOINT=
# LANGFUSE_S3_BATCH_EXPORT_PREFIX=

# S3 storage for events, optional. Ingestion and eval-generated scores persist to GreptimeDB
# raw_events; an event bucket is only needed when LANGFUSE_EVENT_STORAGE_BACKEND=s3 (OTel + eval blobs).
# LANGFUSE_S3_EVENT_UPLOAD_BUCKET=
# Optional prefix to be used within the bucket. Must end with `/` if set
# LANGFUSE_S3_EVENT_UPLOAD_PREFIX=events/
# The following four options are optional and fallback to the normal SDK credential provider chain if omitted
# See https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/setting-credentials-node.html
# LANGFUSE_S3_EVENT_UPLOAD_ENDPOINT=
# LANGFUSE_S3_EVENT_UPLOAD_REGION=
# LANGFUSE_S3_EVENT_UPLOAD_ACCESS_KEY_ID=
# LANGFUSE_S3_EVENT_UPLOAD_SECRET_ACCESS_KEY=

# Object storage is OPTIONAL. Media and the eval observation blob store default to "s3"; set them to
# "local" to run with no S3/MinIO at all (a writable path on a shared volume). Ingestion never needs S3.
# LANGFUSE_MEDIA_STORAGE_BACKEND=local
# LANGFUSE_MEDIA_LOCAL_PATH=/langfuse_media_data
# LANGFUSE_EVENT_STORAGE_BACKEND=local
# LANGFUSE_EVENT_LOCAL_PATH=/langfuse_event_data

# Automated provisioning of default resources
# LANGFUSE_INIT_ORG_ID=org-id
# LANGFUSE_INIT_ORG_NAME=org-name
# LANGFUSE_INIT_PROJECT_ID=project-id
# LANGFUSE_INIT_PROJECT_NAME=project-name
# LANGFUSE_INIT_PROJECT_PUBLIC_KEY=pk-1234567890
# LANGFUSE_INIT_PROJECT_SECRET_KEY=sk-1234567890
# LANGFUSE_INIT_USER_EMAIL=user@example.com
# LANGFUSE_INIT_USER_NAME=User Name
# LANGFUSE_INIT_USER_PASSWORD=password

# Redis configuration
# REDIS_HOST=
# REDIS_PORT=
# REDIS_AUTH=
# REDIS_USERNAME=default
# REDIS_CONNECTION_STRING=
# REDIS_ENABLE_AUTO_PIPELINING=
# REDIS_KEY_PREFIX=  # Optional: Prefix for Redis keys (useful for multi-tenant Redis instances)
                     # BullMQ queues will use this via BullMQ's native prefix option
                     # Cache operations will use this via ioredis keyPrefix
# LANGFUSE_BULLMQ_SKIP_REDIS_VERSION_CHECK=false  # Set to true for Redis-compatible services that report a non-Redis version

# Redis Cluster configuration (optional)
# REDIS_CLUSTER_ENABLED=false
# REDIS_CLUSTER_NODES=redis-node1:6379,redis-node2:6379,redis-node3:6379

# Redis Sentinel configuration (optional, cannot be enabled with cluster mode simultaneously)
# REDIS_SENTINEL_ENABLED=false
# REDIS_SENTINEL_NODES=sentinel1:26379,sentinel2:26379,sentinel3:26379
# REDIS_SENTINEL_MASTER_NAME=mymaster
# REDIS_SENTINEL_USERNAME=
# REDIS_SENTINEL_PASSWORD=

# Cache configuration
# LANGFUSE_CACHE_API_KEY_ENABLED=
# LANGFUSE_CACHE_API_KEY_TTL_SECONDS=
# LANGFUSE_CACHE_PROMPT_ENABLED=
# LANGFUSE_CACHE_PROMPT_TTL_SECONDS=

# GreptimeDB configuration (this fork stores all tracing data in GreptimeDB,
# replacing the upstream ClickHouse store). gRPC 4001 = ingester writes,
# MySQL wire 4002 = reads + migrations. Point the hosts at the greptimedb
# service (here, the docker-compose service/container name `greptimedb`).
# All values have schema defaults in packages/shared/src/env.ts; the entries
# below are the prod-relevant ones — adjust them to match your deployment, and
# uncomment the optional entries further down as needed.
GREPTIME_GRPC_URL="greptimedb:4001"
GREPTIME_SQL_HOST="greptimedb"
GREPTIME_SQL_PORT="4002"
# Optional dedicated read-only MySQL host; falls back to GREPTIME_SQL_HOST.
# GREPTIME_SQL_READ_ONLY_HOST="greptimedb"
GREPTIME_DB="openfuse"
# Auth: a non-empty password turns on enforced GreptimeDB static auth — the greptimedb container
# generates a credentials file and starts with --user-provider, and the app authenticates with the
# same user/password. These two values MUST match. Leave the password empty only for a single,
# unauthenticated node you fully control. Set a strong password for any real deployment.
GREPTIME_USER="openfuse"
GREPTIME_PASSWORD="changeme-greptime-password" # CHANGEME
# Max open connections in the MySQL read pool.
# GREPTIME_SQL_MAX_OPEN_CONNECTIONS=25
# Raw events table name (write-path source of truth).
# GREPTIME_RAW_EVENTS_TABLE=raw_events
# Worker-only: per-field byte cap applied only when reactively truncating an
# oversized row the server already refused (gRPC RESOURCE_EXHAUSTED).
# LANGFUSE_GREPTIME_WRITE_MAX_FIELD_BYTES=1000000

# GreptimeDB database-level retention (TTL), applied to every table at schema bootstrap
# (greptime:migrate). humantime duration; default 730d (2 years). Change the whole store at any
# time with a single ALTER DATABASE ... SET 'ttl'.
# LANGFUSE_GREPTIME_TTL="730d"

# Worker-only: per-table region-statistics sampler (SST file counts, region rows, disk/memtable
# size) emitted as gauges for fragmentation monitoring. A single worker emits each interval via a
# Redis cooldown lock. Disable, or tune the sampling period.
# LANGFUSE_GREPTIME_STATS_ENABLED=true
# LANGFUSE_GREPTIME_STATS_INTERVAL_MS=60000
# Backfill-only: write reconciliation projections via bulk Arrow Flight (decimal-free tables) instead
# of unary gRPC. Off by default; steady-state ingestion is unaffected.
# LANGFUSE_GREPTIME_BULK_BACKFILL_ENABLED=false
# LANGFUSE_GREPTIME_BULK_BATCH_SIZE=10000

# Ingestion configuration
# LANGFUSE_INGESTION_QUEUE_DELAY_MS=
# LANGFUSE_INGESTION_WRITE_BATCH_SIZE=
# LANGFUSE_INGESTION_WRITE_INTERVAL_MS=
# LANGFUSE_INGESTION_WRITE_MAX_ATTEMPTS=

# Evaluation worker concurrency
# LANGFUSE_EVAL_EXECUTION_WORKER_CONCURRENCY=5
# LANGFUSE_LLM_AS_JUDGE_EXECUTION_WORKER_CONCURRENCY=5

# API Traces endpoint controls (may induce breaking changes on API when changed!)
# Reject GET /api/public/traces requests that do not include a fromTimestamp parameter (returns 400)
# LANGFUSE_API_TRACES_REJECT_NO_DATE_RANGE=false
# Apply a default date range (in days) to GET /api/public/traces when no fromTimestamp is provided
# LANGFUSE_API_TRACES_DEFAULT_DATE_RANGE_DAYS=
# Comma-separated default field groups for GET /api/public/traces when no fields param is provided
# Valid values: core, io, scores, observations, metrics
# LANGFUSE_API_TRACES_DEFAULT_FIELDS=
# Comma-separated default field groups for GET /api/public/traces/{traceId} when no fields param is provided
# Valid values: core, io, scores, observations, metrics
# LANGFUSE_API_TRACEBYID_DEFAULT_FIELDS=

# Legacy tracing UI controls
# Disable input/output full-text search in legacy V3 tracing tables (metadata search remains available)
# LANGFUSE_DISABLE_LEGACY_TRACING_IO_SEARCH=false

### START Self-Hosting Configuration

# Allowlisted users that can create new organizations, by default all users can create organizations
# LANGFUSE_ALLOWED_ORGANIZATION_CREATORS=user1@langfuse.com,user2@langfuse.com

# UI Customization Options
# LANGFUSE_UI_API_HOST=https://api.example.com
# LANGFUSE_UI_DOCUMENTATION_HREF=https://docs.example.com
# LANGFUSE_UI_SUPPORT_HREF=https://support.example.com
# LANGFUSE_UI_FEEDBACK_HREF=https://feedback.example.com
# LANGFUSE_UI_LOGO_LIGHT_MODE_HREF=https://static.langfuse.com/langfuse-dev/example-logo-light-mode.png
# LANGFUSE_UI_LOGO_DARK_MODE_HREF=https://static.langfuse.com/langfuse-dev/example-logo-dark-mode.png
# LANGFUSE_UI_DEFAULT_MODEL_ADAPTER=Anthropic # OpenAI, Anthropic, Azure
# LANGFUSE_UI_DEFAULT_BASE_URL_OPENAI=https://api.openai.com/v1
# LANGFUSE_UI_DEFAULT_BASE_URL_ANTHROPIC=https://api.anthropic.com
# LANGFUSE_UI_DEFAULT_BASE_URL_AZURE_OPENAI=https://{instanceName}.openai.azure.com/openai/deployments
# LANGFUSE_UI_VISIBLE_PRODUCT_MODULES=
# LANGFUSE_UI_HIDDEN_PRODUCT_MODULES=

### END Self-Hosting Configuration


### START Langfuse Cloud Config
# Used for Langfuse Cloud deployments
# Not recommended for self-hosted deployments as these are NOT COVERED BY SEMANTIC VERSIONING

# NEXT_PUBLIC_LANGFUSE_CLOUD_REGION="US"
# NEXTAUTH_COOKIE_DOMAIN=".langfuse.com"

# LANGFUSE_TEAM_SLACK_WEBHOOK=
# LANGFUSE_NEW_USER_SIGNUP_WEBHOOK=

# Posthog (optional for analytics of web ui)
# NEXT_PUBLIC_POSTHOG_HOST=
# NEXT_PUBLIC_POSTHOG_KEY=

# Sentry
# NEXT_PUBLIC_LANGFUSE_TRACING_SAMPLE_RATE
# NEXT_PUBLIC_SENTRY_DSN=
# NEXT_SENTRY_ORG=
# NEXT_SENTRY_PROJECT=
# SENTRY_AUTH_TOKEN=
# SENTRY_CSP_REPORT_URI=


# Demo project that users can use to try the platform
# NEXT_PUBLIC_DEMO_ORG_ID=
# NEXT_PUBLIC_DEMO_PROJECT_ID=

# Plain Chat
# NEXT_PUBLIC_PLAIN_APP_ID=
# PLAIN_AUTHENTICATION_SECRET=
# PLAIN_CARDS_API_TOKEN=

# Pylon Support
# PYLON_API_KEY=

# Admin API
# ADMIN_API_KEY=
# Self-hosted only: allow internal LLM proxy hosts/IPs for LLM connection base URLs.
# LANGFUSE_LLM_CONNECTION_WHITELISTED_HOST=
# LANGFUSE_LLM_CONNECTION_WHITELISTED_IPS=
# LANGFUSE_LLM_CONNECTION_WHITELISTED_IP_SEGMENTS=
# Self-hosted only: allow internal hosts/IPs for user-configured blob storage endpoints.
# LANGFUSE_BLOB_STORAGE_ENDPOINT_WHITELISTED_HOST=
# LANGFUSE_BLOB_STORAGE_ENDPOINT_WHITELISTED_IPS=
# LANGFUSE_BLOB_STORAGE_ENDPOINT_WHITELISTED_IP_SEGMENTS=
# LANGFUSE_CACHE_MODEL_MATCH_ENABLED=
# LANGFUSE_CACHE_MODEL_MATCH_TTL_SECONDS=

# Rate limiting
# LANGFUSE_RATE_LIMITS_ENABLED=

# Optional BCC address for system emails (e.g., for CRM integration like HubSpot)
# CLOUD_CRM_EMAIL=

# Stripe
# STRIPE_SECRET_KEY=
# STRIPE_WEBHOOK_SIGNING_SECRET=

# Betterstack Status Page
# BETTERSTACK_UPTIME_API_KEY=
# BETTERSTACK_UPTIME_STATUS_PAGE_ID=

### END Langfuse Cloud Config


### START Langfuse CI Config

# LANGFUSE_INIT_ORG_CLOUD_PLAN=

### END Langfuse CI Config