How to restrict access to Langfuse projects within an organization

[hkrpydev-hkr]

Describe your question

Hello, we have created one organization in a self hosted open source Langfuse setup and have multiple projects created based on different GenAI applications. We want to restrict access to GenAI application teams so they can only see their specific projects once they login to Langfuse and not see other projects, but when we try to manage access at a project level we don't see any option.
We only see an option to manage access at an organization level but not at a project level.

Is this doable?

Langfuse Cloud or Self-Hosted?

Self-Hosted

If Self-Hosted

3.124.1

If Langfuse Cloud

No response

SDK and integration versions

No response

Pre-Submission Checklist

• I have checked for existing issues/discussions and consulted Langfuse AI.

[inkeep-ai-assistant[bot]]

Project-level access control is available in Langfuse, but it requires either the Pro plan with the Teams add-on or the Enterprise Edition for self-hosted deployments.(1)

For your self-hosted open source setup on version 3.124.1, project-level roles are not available in the standard open source version. This feature is part of the Enterprise Edition.(1)(2)

Here's how project-level access control works when available:

Users by default inherit the role of the organization they are part of. For more fine-grained control, you can assign a user a role on the project level, which overrides the organization-level role for that project.(1)

If you want to give a user access to only certain projects within an organization, you can set their role to None on the organization level and then assign them a role on the project level.(1)

For your current setup, you have two options:

1. Upgrade to Enterprise Edition - This will enable project-level RBAC features, allowing you to restrict users to specific projects within your organization.(1)(2)

2. Use separate organizations - As an alternative with the open source version, you can create separate organizations for each GenAI application team. Each organization would have its own projects, members, and API keys, providing the isolation you need.(3)

The organization-based approach would give you the access control you're looking for, though it requires managing multiple organizations instead of multiple projects within a single organization.(3)

📚 Sources:

1. Role-Based Access Controls in Langfuse
2. Administration Overview (self-hosted)
3. How to manage different environments in Langfuse?

---

Have another question? Just tag @inkeep.

[jannikmaierhoefer]

Hi @hkrpydev-hkr, inkeep is correct. Project-level RBAC features are part of our self-hosted enterprise offering.