Credential-safe round-trip

The optional Langfuse round-trip is designed so the observability owner can clear a security veto: UserVane is not in the eval write path and never custodians your Langfuse secret.

Who holds what

Secret	Where it lives
UserVane publishable key (uv_pk_...)	Browser / client SDK
UserVane secret key (uv_sk_...)	Your server (mint tokens, poll pending scores, privacy)
Langfuse public + secret keys	Your server only (@uservane/langfuse-push)

UserVane never receives, stores, or transmits the Langfuse key. There is no “paste your sk-lf into the UserVane dashboard” path for score push.

Flow

Respondent  --(publishable key + show-token)-->  UserVane ingest
                                                      |
                                                      v
                                              linked row queued
                                                      |
Your cron  --(UserVane secret)-->  GET /v1/sdk/pending-scores
       |                                  |
       +-- Langfuse.score(sessionId) <----+
       |
       +-- POST /v1/sdk/pending-scores/ack

1. Client captures a response through normal token-verified ingest.
2. If the response is linked (session-bound token path), UserVane queues it for score delivery.
3. Your process runs pushPendingScores with both credential sets.
4. A namespaced session-level score is written (uservane.satisfaction by default).
5. Your process acks delivered or failed per id.

Why this shape

• Gatekeeper veto: the Langfuse owner keeps write credentials in their own runtime.
• Never-lost (with your adapter): pending/failed state lives in UserVane; your server retries. The guarantee assumes the server adapter keeps polling, not a client pusher.
• Namespace: scores use a uservane.* name so they do not silently pollute your own eval queries.

Dashboard-only is complete

You can capture and read feedback in UserVane without wiring Langfuse. Skipping the push is a supported configuration, not a half install.

Deep walkthrough: Langfuse round-trip end to end.