Skip to main content
A credential is a stored connection to one external trace source, like a Langfuse project. You give Bento the keys to read from it, and a background scheduler pulls runs in on a schedule you control. The credentials group holds those connections; the sync group watches the import that pulls runs in. Runs can also arrive without a credential, by pushing OTLP directly with a workspace API key; that path lives on the Workspace settings page. A credential carries three things. Its source type is langfuse (the example throughout this page). Its config is the connection details: for Langfuse, public_key, secret_key, and base_url. Its health is last_health_status, which reads ok or fail, and transiently unknown before the first probe. The sync side reports on the import. Workspace settings hold the schedule: schedule_enabled, frequency_minutes, next_run_at, and max_traces_per_sync. Status is one credential’s live import state: idle, running, ok, fail, or partial. Reports record what each completed run created, updated, skipped, or failed. A doctor diagnoses health across credentials.

​
Commands

Where the workspace comes from. credentials list / create and every sync command that targets the workspace use --workspace or your saved default. The id-path commands (credentials get / update / delete / run-health-check and sync status) take a credential_id positionally and are not workspace-scoped.

​
Connect a source

Connect a Langfuse source by passing source_type and a config with the source’s keys. The create runs a health check synchronously, so the response already carries last_health_status:
List what’s connected, or open one to read its health and redacted config:
Recheck the connection on demand without changing anything:
Rotate the keys by rewriting the full config. This is a replace, and it re-runs the health check:
Disconnect a source when you’re done with it:

​
Watch the import

Connecting a source schedules the first pull immediately. From there, sync is how you watch and tune it. Read the schedule:
Tune it by PATCHing only the fields you want. frequency_minutes accepts 15–10080; max_traces_per_sync accepts 5000–10000:
Check the live state of one credential’s import, or read the recent runs:
Diagnose problems across every credential, including upstream reachability:
There’s no “sync now” or “stop sync” command. The import runs on the schedule you set with update-workspace-settings; run-health-check is the only on-demand action, and it probes the connection rather than triggering a pull.

​
See also

Runs

The raw runs an import brings in.

Workspace settings

Push runs with an API key instead of importing them.

Issues

The tracked problems Bento finds in those runs.