Langfuse

Probo reads your Langfuse organization’s members through the organization-scoped public API so you can review who has access.

Caution

Create an organization-scoped API key from your organization’s settings, not a project API key from a project’s settings. Langfuse issues both kinds as the same pk-lf- public key and sk-lf- secret key pair, so the prefix does not tell you which kind you hold. The settings page you created the key on is the only way to tell. The organization memberships endpoint rejects a project key with Invalid API key. Organization-scoped API key required for this operation. Paste the pair into Probo as a single pk-lf-…:sk-lf-… string, public key first, because Langfuse authenticates it as an HTTP Basic credential.

Prerequisites

• Probo organization administrator access
• The Owner role in the Langfuse organization (Langfuse grants organization:CRUD_apiKeys to Owner only, so an Admin, Member or Viewer cannot create the key)
• A Langfuse plan that includes the organization management API, which Langfuse gates behind the admin-api entitlement. Langfuse’s availability table for SCIM & Organization-Key Scoped API Routes lists Hobby, Core and Pro as not available, Langfuse Cloud Enterprise as available, and self-hosting as requiring the Enterprise Edition. If your organization is on a legacy or individually negotiated plan, confirm the entitlement with Langfuse. Without it Langfuse hides the API Keys tab and the memberships endpoint answers This feature is not available on your current plan.
• The Base URL of the Langfuse instance you are reviewing, which the Connect dialog asks for alongside the key. On Langfuse Cloud it is the host you sign in to: https://cloud.langfuse.com (EU), https://us.cloud.langfuse.com (US), https://jp.cloud.langfuse.com (Japan) or https://hipaa.cloud.langfuse.com (HIPAA). A self-hosted instance uses its own deployment URL. Enter the host on its own, without the /api/public path

Collected Fields

Probo field	Langfuse field	Notes
Name	name	Falls back to the email address
Email	email	A membership with no email address is skipped
Role	role	OWNER → Owner, ADMIN → Admin, MEMBER → Member, VIEWER → Viewer, NONE → None. Any other value is kept verbatim
Admin	role	Flagged as an administrator when role is OWNER or ADMIN
Status	Not supported
MFA	Not supported
Last login	Not supported
External ID	userId	Stable identifier used to track the account across reviews
Created at	Not supported

The memberships endpoint returns one record per organization member, with no filter on the role. Collaborators who work in a single project are still organization members with the organization role None, so they appear in the review as well. The endpoint does not return pending invitations.

Step 1: Create an Organization-Scoped API Key

1. In Langfuse, signed in as an organization Owner, open the organization you want to review and click Settings in the sidebar to reach Organization Settings.
2. Open the API Keys tab and click Create new API keys.
3. Fill in Note (optional) (e.g. Probo Access Review) and click Create API keys.
4. Copy the Public Key and the Secret Key and store them securely. Langfuse shows the secret key only once and displays a masked version after that.

Step 2: Connect in Probo

1. In Probo, go to Access Reviews > Sources > Add Source.
2. Find Langfuse, click API Key, paste the two keys as one pk-lf-…:sk-lf-… string (public key, a colon, then the secret key) into the API key field, enter your Base URL (the Langfuse host you sign in to, or your self-hosted deployment URL), and click Connect.

Probo names the source Langfuse and pulls your organization’s members into your campaigns. The memberships endpoint carries no organization name, so the source keeps that generic name.

Troubleshooting

• No API Keys tab in organization settings. Langfuse shows the tab only when the organization’s plan includes the organization management API and you hold the Owner role. Check both before creating the key.
• Key rejected. Confirm you created the key on the organization settings page rather than on a project’s settings page, that you pasted both halves as pk-lf-…:sk-lf-… with the colon in between, and that the Base URL is the same Langfuse host you created the key on. Each cloud region is a separate deployment, so a key from one host does not authenticate against another.
• “This feature is not available on your current plan.” The organization management API is gated on the plan, not on the key. Langfuse lists it as available on Langfuse Cloud Enterprise and on a self-hosted Enterprise Edition deployment. Move the Langfuse organization onto a qualifying plan, or confirm the entitlement with Langfuse, then connect again.
• No members appear. An organization-scoped key is bound to the organization you created it in and lists only that organization’s members. Create the key inside the organization you want to review.