LangSmith
Purpose
Collects LangSmith organizations, workspaces, members, roles and permissions, access policies, personal access tokens, service keys, SSO and SCIM settings, deployments, agents, and the third-party OAuth credentials that agents hold on users' behalf.
tip
Secret fields below accept either an AWS Secrets Manager ARN or a value pasted directly into SubImage's managed vault. See Secrets for details.
Required Fields
| Field | Secret? | Description |
|---|---|---|
langsmith_pat |
Yes | LangSmith personal access token (lsv2_pt_...) for an organization admin |
Optional Fields
| Field | Description |
|---|---|
langsmith_org_id |
Organization UUID to sync. If you leave it empty, SubImage syncs every organization the token can see. |
langsmith_api_url |
Control plane URL. Defaults to https://api.smith.langchain.com. |
langsmith_host_api_url |
LangGraph Platform URL. Defaults to https://api.host.langchain.com. |
Setup Steps
- Sign in to LangSmith as a user with the Organization Admin role, or a custom role with
organization:read,organization:read-metadata, andworkspaces:read. - Go to Settings > Personal access tokens and create a token.
- In SubImage, enter the token in
langsmith_pat. - For the EU region, set
langsmith_api_urltohttps://eu.api.smith.langchain.comandlangsmith_host_api_urltohttps://eu.api.host.langchain.com. - Save the module and run a sync.
Notes
- The sync is read-only. SubImage never reads secret values, OAuth access tokens, or full API keys.
- Use a personal access token. A workspace service key (
lsv2_sk_...) can't reach the organization-level routes. - Grant
deployments:readto collect deployments, agents, and agent credentials, andorganization:pats:readto collect other members' personal access tokens. Without them, SubImage skips that data and logs a warning. - If the token can't read a workspace, SubImage keeps the data it collected earlier rather than deleting it.
Troubleshooting
| Symptom | Fix |
|---|---|
| LangSmith authentication failed | The token expired or its user was deactivated. Create a new personal access token. |
| LangSmith access denied | Use a personal access token, not a service key, from a user with organization:read. |
| No agents or agent credentials | Grant the token's user deployments:read in each workspace that runs deployments. |