Skip to content
Langfuse LLM Observability Observability · Langfuse 4.56.0 Launch on AWS

Getting started

This page takes you from the AWS Marketplace listing to a signed-in Langfuse UI with your first trace: subscribe, launch the instance, connect, open the UI and send traces.

You need: an AWS account with permission to subscribe to AWS Marketplace products, launch EC2 instances and use AWS Systems Manager, and, on your workstation, the AWS CLI with the Session Manager plugin.

1. Subscribe

Open the Langfuse LLM Observability listing in AWS Marketplace, choose View purchase options, review the terms and subscribe. When the subscription is confirmed, choose Launch your software.

2. Launch the instance

On the EC2 launch page:

  1. Keep the instance type at t3.large, or choose one with at least 8 GiB of memory.
  2. Under Configure storage, use an encrypted gp3 root volume of at least 40 GiB.
  3. Under Network settings, allow no inbound traffic. Every service listens only on the instance itself, and Session Manager does not need an open port. If you also want SSH, allow port 22 from your administrative address range only.
  4. Under Advanced details, choose an IAM instance profile that includes the AWS managed policy AmazonSSMManagedInstanceCore, and require IMDSv2.
  5. Choose Launch instance.

Session Manager needs outbound HTTPS

The instance reaches Systems Manager over outbound HTTPS. Keep the default outbound rule, or provide VPC endpoints for Systems Manager.

3. Connect and wait for first boot

In the EC2 console, select the instance, choose Connect, then Session Manager, then Connect. Or, from your workstation:

aws ssm start-session --target <instance-id>

Switch to the ubuntu user and wait for first boot to finish:

sudo -iu ubuntu
cloud-init status --wait
systemctl is-active sushi-langfuse-firstboot langfuse

Both services report active once the containers are started. The first start runs database migrations and can take several minutes before the UI answers.

4. Run the walkthrough

bash /opt/sushi/docs/demo.sh

It waits for the stack, checks that the UI listens on loopback and reports healthy, confirms that ubuntu cannot read the secret files, then runs the image's self-test, which sends a trace over OpenTelemetry and reads it back. It ends with SUSHI_CUSTOMER_DEMO_PASSED.

5. Get the admin password

The password is stored only on the instance, readable by root:

sudo cat /etc/langfuse/admin.password

The sign-in email is admin@localhost.local. Keep the password out of tickets, chat and screen recordings.

6. Open the UI

On your workstation, start a port-forwarding session. Replace <instance-id> and use the instance's region:

aws ssm start-session \
  --target <instance-id> \
  --document-name AWS-StartPortForwardingSession \
  --parameters '{"portNumber":["3000"],"localPortNumber":["3000"]}'

Leave it running and open http://127.0.0.1:3000 in your browser. Sign in as admin@localhost.local with the password from step 5. The project Sushi Pilot is ready, and the walkthrough's test trace appears under Tracing.

Send traces

You need the project's public and secret keys. Use the keys created on first boot, or create new ones in the project settings in the UI:

sudo cat /etc/langfuse/project-api.env

Then send traces in one of these ways:

  • A Langfuse SDK. Use Python SDK 4.7.0 or later, or JS/TS SDK 5.4.0 or later, with the host http://127.0.0.1:3000 (through the tunnel, or from an application on the instance) and the project keys.
  • Any OpenTelemetry exporter. Send OTLP/HTTP to http://127.0.0.1:3000/api/public/otel/v1/traces, with HTTP Basic authentication (public key as user name, secret key as password) and the header x-langfuse-ingestion-version: 4. Set the span attributes langfuse.observation.input and langfuse.observation.output to record input and output.

Older SDKs cannot create traces

Python SDK v2 and older, and JS/TS SDK v3 and older, use the legacy batch endpoint /api/public/ingestion. On this image it answers HTTP 207 but rejects every event except scores, so no traces are stored. Upgrade the SDK.

Read traces through the API

Read observations with the Observations API v2. Bound the request by start time, and ask for the io field group to include input and output:

curl -sS -u '<public-key>:<secret-key>' \
  'http://127.0.0.1:3000/api/public/v2/observations?fromStartTime=<start>&toStartTime=<end>&fields=core,basic,io'

Use ISO 8601 UTC times such as 2026-01-01T00:00:00Z. Add traceId=<id> to select one trace; a trace is its root observation plus its children, so group rows by traceId. The legacy GET /api/public/traces routes return HTTP 404 on this image.

Next, read Configuration.

Last updated October 13, 2026 · Suggest an improvement