Langsmith API Key in langchain react sdk useStream

OSS Product Help LangGraph
,
1

Hi all, I may be misunderstanding the docs, but from what I can gather in the frontend langchain docs (Frontend - Docs by LangChain) it seems that if our agents are hosted on langchain cloud (langsmith now) and we use useStream we have to pass the langsmith api key in useStream which lives on the client. This will expose the api key to the client though. Am I missing something? Are there any recommended approaches or patterns regarding this?

2

hi @iss44

LangSmith-hosted (deployment) endpoints use API keys by default and require a valid key in the x-api-key header (docs). In the JS SDK, the apiKey option is literally turned into an x-api-key header on requests.

What the frontend docs mean: the useStream docs say “API key … required when connecting to deployed agents on LangSmith” (docs). That’s true, but it’s describing authentication requirements, not endorsing putting a long-lived secret into untrusted client code.

Recommended patterns

  1. Backend proxy

    • Keep the LangSmith API key on a server (env var).
    • Expose your own endpoint (Next.js route / Express / FastAPI / etc.) that:
      • authenticates the user (cookie/JWT/session),
      • calls the LangSmith deployment using the server-side API key,
      • streams the response back to the browser (SSE).
    • On the client, point useStream at your own endpoint (or use useStreamCustom + FetchStreamTransport) so no LangSmith key ever reaches the browser.

  2. Custom auth on the deployment (browser uses per-user tokens, not a shared secret)

    • LangSmith supports replacing the default API-key model with your own auth handler (JWT/session/etc.) (docs).
    • Then the browser can send its normal user auth token (e.g. Authorization: Bearer <jwt>), and the deployment validates it and applies authorization rules per user/thread.
    • This avoids a single “god key” entirely and is the right choice for multi-tenant apps where users shouldn’t see each other’s threads/runs.

  3. Self-hosted

    • Self-hosted Agent Server has no default authentication and you can implement whatever security model you want (docs).

Practical note

If you’ve already put a LangSmith API key into client code (even briefly), assume it’s compromised and rotate/revoke it.