Use JWTs for API private key

[Manouchehri]

Describe the feature or potential improvement

While thankfully Langfuse isn't being DDoS yet, it wouldn't be a bad idea to proactively use JWTs for the private key / "password" part of the API authentication.

This would allow adding stateless token verification at the edge (with a Cloudflare Worker or Lambda@Edge) in the future, before doing an "expensive" call to the Langfuse database.

Copied some starter code/notes for you from one of our internal projects. =)

import { SignJWT, importPKCS8 } from "jose";

// openssl ecparam -name prime256v1 -genkey -noout -out private_key.pem
// openssl ec -in private_key.pem -pubout -outform PEM -out public_key.pem
// openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in private_key.pem -out ec_private_key_pkcs8.pem

// cat public_key.pem
const PUBLIC_KEY_STRING = `-----BEGIN PUBLIC KEY-----
MFkw...
-----END PUBLIC KEY-----
`
const PRIVATE_KEY_STRING = `-----BEGIN PRIVATE KEY-----
MIGHAgE...
-----END PRIVATE KEY-----
`
// We want to use PKI here as it allows us to put the public key (instead of a shared key) at the edge without needing to keep secrets.
const imported_privkey = importPKCS8<CryptoKey>(PRIVATE_KEY_STRING, 'ES256');

const current_server = "https://us.cloud.langfuse.com";
const private_api_key = new SignJWT({})
  .setIssuer(current_server)
  .setJti(randomUUID()) // The JWT will likely be stateless anyway, but this is a good practice
  .setIssuedAt() // Important to have this as a way to retroactively "revoke" old tokens if needed
  .setSubject("cls6owfs500029r3k5t9xh34e") // Langfuse Project ID here
  .setAudience(`${current_server}/api/public/`) // define a "scope" of what should be accessed
  .setProtectedHeader({alg: "ES256"})
  .sign(await imported_privkey);

Additional information

No response

Contribute

• Yes, I can implement this and raise a PR

[marcklingen]

Thanks, this is super helpful (especially the snippet)! currently db access is necessary to verify api keys, switching to JWT would improve the project's ddos protection a lot indeed

[Manouchehri]

IMO you'll always need db access to fully verify API keys (as 100% stateless auth is questionable, since you end up with no sane revocation or auditing mechanisms), but yeah, this would help with DDoS protection as you could drop requests before they even call into Langfuse. =)

Now that I think about it, making Langfuse's private key a JWT too probably makes sense. Wouldn't hurt, and shouldn't make any real perf difference since you hash it anyway.

[Manouchehri]

On second thought, make the private key a JWT instead of the public key. You'd still be able to validate it the same at the edge with basic auth.

Having the public being longer than the private key is likely going to confuse some new users. I would say make both a JWT.. but then you will confuse users about which is which (as they both look like similarly random strings).