HTTP Proxy Configuration#

Langfuse self-hosted deployments support two distinct proxy channels: one for outbound LLM API calls and one for SSO/OAuth authentication flows. These are configured via separate environment variables targeting different parts of the stack.

LLM Requests: HTTPS_PROXY + Undici ProxyAgent#

The HTTPS_PROXY environment variable routes all outbound LLM provider requests through a proxy. It is declared as an optional string in packages/shared/src/env.ts.

At runtime, fetchLLMCompletion.ts reads this variable and constructs an Undici ProxyAgent:

const proxyUrl = env.HTTPS_PROXY;
const proxyDispatcher = proxyUrl ? new ProxyAgent(proxyUrl) : undefined;

The dispatcher is then passed as fetchOptions: { dispatcher: proxyDispatcher } to each LLM client adapter:

• Anthropic — via clientOptions.fetchOptions 1
• OpenAI — via configuration.fetchOptions 2
• Azure OpenAI — via configuration.fetchOptions 3

Note: The Bedrock and VertexAI adapters do not currently pass a proxy dispatcher, as they connect to fixed regional endpoints or use credential-based auth libraries.

The LLM completion timeout (LANGFUSE_FETCH_LLM_COMPLETION_TIMEOUT_MS, default 120 seconds) is read alongside the proxy in the same block 4.

SSO/NextAuth Requests: AUTH_HTTPS_PROXY / AUTH_HTTP_PROXY#

NextAuth's OpenID client handles OAuth token exchange and provider discovery. Because NextAuth does not natively support proxy configuration, Langfuse applies patch files to the installed package.

Environment variables (in web/src/env.mjs):

Implementation — The patches modify core/lib/oauth/client.js inside next-auth to inject HttpsProxyAgent from the https-proxy-agent package before calling _openidClient.custom.setHttpOptionsDefaults():

• patches/next-auth@4.24.11.patch — initial proxy agent injection
• patches/next-auth@4.24.12.patch — same, plus AUTH_SSO_TIMEOUT support

The patch logic:

1. Preserves any existing provider.httpOptions
2. Sets httpOptions.timeout from AUTH_SSO_TIMEOUT (if valid)
3. Sets httpOptions.agent = new HttpsProxyAgent(AUTH_HTTPS_PROXY || AUTH_HTTP_PROXY) when either is present
4. Calls setHttpOptionsDefaults(httpOptions) — which applies globally to the OpenID client

See PR #10300 for the original fix and motivation (issues with NextAuth's default proxy setup and missing timeout support).

NO_PROXY#

There is no NO_PROXY support implemented in Langfuse. If you need to exclude certain hosts, configure exclusions at the proxy server level or via your infrastructure's networking layer.

Architecture Summary#

Self-hosted Langfuse
│
├── LLM workers (fetchLLMCompletion.ts)
│ └── HTTPS_PROXY → Undici ProxyAgent → LLM Provider APIs
│ (OpenAI, Anthropic, Azure, ...)
│
└── Web server (NextAuth)
    └── AUTH_HTTPS_PROXY / AUTH_HTTP_PROXY
        → https-proxy-agent (via next-auth patch)
        → OAuth/OIDC Provider (token exchange, discovery)

Key Files#