Langfuse secret keys

• trufflehog 3.97.4
• betterleaks
• Reference 1
• Reference 2
• Reference 3
• Reference 4

Graduated arrival contract (#210, registry detector since redact-secret#728; research #221 observed 2026-09-24). Covers only issuer-minted keys: Langfuse's own key generator (provider code, unchanged from 2023-06 to 2026-09) builds sk-lf-${randomUUID()}, i.e. sk-lf- plus a lowercase RFC 4122 version-4 UUID (42 characters; version nibble 4, variant nibble 8/9/a/b), and uses the same generator for project, organization and AI-gateway keys. Langfuse documentation shows the sk-lf-/pk-lf- prefixes and the contexts (LANGFUSE_SECRET_KEY, SDK constructors, Basic auth public-key:secret-key, OTLP Authorization=Basic) but states no body grammar, so the tier stays T2: the body is provider code corroborated by trufflehog 3.97.4 (which also requires a langfuse keyword and the paired pk) and betterleaks. The public key pk-lf-<uuid> is documented as safe for browser code and is this family's public-prefix twin and public-id control. Self-hosted operator-defined keys (headless init accepts any string; the admin API enforces only the sk-lf- prefix) are simply outside the minted-shape claim: none is fixtured, and none is asserted silent. The sk-lf-gw- form appears only in a PR description, Storybook stories and a unit-test fixture; it is recorded, neither claimed nor asserted silent. A base64 Basic-auth blob carries the secret only in encoded form; this contract makes no claim on it and it is not fixtured as a control. gitleaks 8.30.1 has no Langfuse rule.