Does the Langfuse connector work on Hermes Agent as well as OpenClaw?

Yes. The Tools catalog is shared and the connect steps are identical on both frameworks. Only the install path differs: the skill lands in /opt/data/skills on Hermes and in /home/node/.openclaw/workspace/skills on OpenClaw.

What exactly do I paste into the token field for Langfuse?

The base64 encoding of public-key:secret-key. Langfuse uses HTTP Basic auth and this connector sends the token verbatim after the word Basic, so it does not encode the pair for you. Pasting a bare secret key returns 401 on every call.

How do I test whether the credential works?

GET /api/public/health only proves the host is reachable and reports its version. GET /api/public/projects requires the credential, so it is the call that actually tests it.

Is it safe to give a bot access to my traces?

Treat it as sensitive. Traces contain the prompts and completions of your application, which often include user data, and a bot holding the key can read all of it. Use a project-scoped key and consider who is able to talk to that bot.

← Home

Guide

Langfuse

Observability is normally something you go and look at. Connect Langfuse’s public API to a bot and it becomes something you can ask about instead — what ran, what it scored, what it cost. Same connector on Hermes and OpenClaw.

What This Is Good For

Langfuse records traces of LLM work: the calls, their inputs and outputs, latency, token counts, cost, and any evaluation scores you attach. The dashboard is where you read that normally. This connector gives an agent read access to the same API, which turns a few recurring chores into a question:

“Summarise yesterday’s failed traces and group them by cause.”
“Which prompt version is scoring worst this week?”
“What did this project spend since Monday, and on which model?”

One caution worth stating plainly: traces contain the prompts and completions of your application, which frequently means user data. A bot given this credential can read all of it. Scope the key, and think about who talks to that bot.

The Auth Gotcha — Read This First

Langfuse’s public API uses HTTP Basic authentication: your public key is the username and your secret key is the password. Normally a client encodes that pair for you. This connector does not — it sends the token you paste verbatim after Basic . So the value that belongs in the token field is the base64 of public-key:secret-key, not either key on its own.

Produce it wherever you are comfortable, for example:

printf '%s' 'pk-lf-xxxxxxxx:sk-lf-xxxxxxxx' | base64

Paste that output, set the auth mode to Basic token, and you are done. Paste a bare secret key instead and every call returns 401 — this is the single most common way this connector is set up wrong.

Connect It

Open the dashboard, go to Tools, and pick the running bot. Tools are installed per instance.
Find Langfuse and connect it, with your host: Langfuse Cloud (https://cloud.langfuse.com, or the US region host) or your own https://langfuse.example.com. HTTPS is required.
Create an API key pair in the Langfuse project settings, choose Basic token, and paste the base64 value from above.

The steps are identical on Hermes Agent and OpenClaw.

Verify It

Two calls settle it, and they answer different questions. /api/public/health returns {"status":"OK","version":...} and proves the host is reachable and which version it is running. /api/public/projects is the one that proves your credential:

# Hermes — reachability and version
/opt/data/tools/dashboard-api-connectors/langfuse/tool get /api/public/health

# OpenClaw — this one needs the Basic token to succeed
/home/node/.openclaw/tools/dashboard-api-connectors/langfuse/tool get /api/public/projects

Everything lives under /api/public: observations, metrics, scores, sessions, prompts. If you connect the endpoint as https://cloud.langfuse.com/api/public rather than the bare host, the client is confined to that subtree and your paths get shorter — a reasonable way to keep the credential away from the rest of the host.

What the Connector Will and Will Not Allow

Query strings are allowed on the path, which matters here — the Langfuse API filters and paginates with them. The endpoint you save may not carry one, but a request path may.
Paths cannot escape the endpoint, and traversal segments and nested encoding are rejected.
Redirects are refused while the client holds your credential.
A response over 5 MB is refused, with an error rather than a partial body, and a call that goes 120 seconds without data is dropped. Page through results rather than asking for a month at once.

Where It Lands in Your Bot

Hermes Agent: skill at /opt/data/skills/openclaw-launch-langfuse.
OpenClaw: skill at /home/node/.openclaw/workspace/skills/openclaw-launch-langfuse.

Troubleshooting

401 everywhere, health is fine. The token is not base64 of public:secret. Re-encode and reconnect.
Health looks fine but queries fail. The plain health call deliberately does not check the database — it answers OK as long as the API process is up. To include the database, ask for /api/public/health?failIfDatabaseUnavailable=true, which returns 503 when it cannot reach it. This is one of the places the query string on a request path earns its keep.
Empty results from a correct-looking query. Keys are per project. A key from project A cannot see project B’s traces.
An error saying the response exceeded 5 MB. Nothing is printed when that happens — it is refused, not trimmed. Narrow the time window or use the pagination parameters.

Try It

Connect it and ask your bot for the version of your Langfuse and the list of projects it can see. If both come back, the credential is encoded correctly and you can move on to the questions you actually care about.