Access and credentials
This page lists every credential and every kind of access a project needs to trace an agent and evaluate it with this SDK and the two shared services: where each one comes from, whether you can get it yourself, and whom to ask when you cannot.
Contact for access, keys and questions: Peter Ewald, on Microsoft Teams or
at peter.ewald@ramboll.com.
Never commit any of these values. Keep them in the project's .env, which is
gitignored, and name only the variables in .env.example.
What you need, and where it comes from
| Credential or access | Variables | What it unlocks | Where it comes from | Self-service |
|---|---|---|---|---|
| VPN | none | The deployed scoring and review-sync services, Azure Key Vault, and the Artifactory install | Ramboll IT, as for any other internal system | No, through IT |
| Artifactory token | ~/.netrc (not an environment variable) |
Installing semantic-evaluation and semantic-tracing from the internal index ramtech-pypi-internal |
Artifactory UI, Edit Profile → Authentication Settings. See Install | Yes, once you can sign in to Artifactory. If you cannot, ask the contact |
| Langfuse project keys | LANGFUSE_PUBLIC_KEY, LANGFUSE_SECRET_KEY, LANGFUSE_BASE_URL |
Tracing, datasets, experiments and annotation queues in your Langfuse project | Your Langfuse project, Settings → API Keys. LANGFUSE_BASE_URL is the Langfuse instance, for example https://cloud.langfuse.com |
Yes, in a Langfuse organisation you belong to. To join the team's organisation, ask the contact |
| Azure OpenAI values | AZURE_OPENAI_ENDPOINT, AZURE_OPENAI_API_KEY, AZURE_OPENAI_DEPLOYMENT |
Your agent's own model calls, and the model behind an LLM-judge connection profile | The Azure portal page of your Azure OpenAI resource (Keys and Endpoint) and its deployments | Yes, if your project has a resource. The resource must sit in an EU/EEA region; the approved list is not agreed yet, so ask the contact before choosing one |
| Scoring service key | SCORING_SERVICE_API_KEY |
Your pod's identity to the scoring service, and reading connection profiles, evaluator backends and submitting named rubrics. execute_offline_evaluation sends it from the environment when no scoring_service_api_key is passed |
Issued by the platform team as your own caller key (Key Vault secret scoring-caller-<caller-id>) |
No, ask the contact |
| Review-sync service key | REVIEW_SYNC_API_KEY |
Your pod's identity to the review-sync service, and registering your project's Langfuse profile (eval-review register-profile, review sync) |
Issued by the platform team as your own caller key (Key Vault secret review-sync-caller-<caller-id>) |
No, ask the contact |
| LLM-judge connection profile | none in your project | Every LLM-judge metric. Deterministic and routing metrics need none | Registered on the deployed scoring service by the platform team with POST /v1/connection-profiles (the platform-admin caller only), from Azure OpenAI values you supply. See connection profiles |
No, ask the contact to register it. On a local service you register it yourself |
The service keys are caller keys: each pod has its own key per service, and the platform team issues, rotates and revokes them. Workshop attendees get the workshop caller's keys from the facilitator. How keys are issued is in the scoring service's deployment page.
Which service routes need a key
Always set your caller keys: the scoring and sync routes are in a warning phase (a call with a known key is identified, and one without is still accepted), and a key becomes required from an enforcement date announced in each service's changelog.
| Service | Platform-admin caller only | Any known caller | Warning phase | Open |
|---|---|---|---|---|
| Scoring | POST/DELETE on /v1/connection-profiles, PUT /v1/evaluator-backends/{backend}/connection-profile, GET /v1/evaluators/requests |
GET /v1/connection-profiles, GET /v1/evaluator-backends, POST /v1/evaluators/requests |
POST /v1/score-jobs, GET /v1/score-jobs/{id} |
/health, GET /v1/evaluators |
| Review sync | none | every /v1/langfuse-profiles route, reads included |
every /v1/bindings route, POST /v1/sync-jobs, GET /v1/sync-jobs/{id} |
/health |
A local service has no CALLER_KEY_VAULT_URL, so every route is open there.
The routes are versioned by API major; the SDK picks the version (see service API versions). The base URLs of the deployed services are in each service's API reference: scoring and review sync.
When access fails
| Symptom | Usual cause |
|---|---|
HTTP 401 from artifactory.ramboll.com during uv sync |
No token in ~/.netrc, or an expired one |
The install cannot reach artifactory.ramboll.com, or a service URL does not resolve |
Not on the VPN |
HTTP 401 Invalid or missing API key. from a service route |
X-API-Key is missing, or is a key no caller has (revoked, mistyped, or for the other service) |
HTTP 403 This route needs the platform-admin caller. |
A pod key on an admin route; ask the platform team to do it |
| HTTP 400 from the scoring service for an LLM-judge metric | No connection profile registered for that evaluator backend |
setup_tracing(require_langfuse=True) fails to authenticate |
Wrong Langfuse keys, or LANGFUSE_BASE_URL names a different instance than the project's |
Check that a service is reachable with GET /health before looking for a fault
in your own code.