"
```
The provider ID must be unique and cannot end with `-agent-builder` or `-oauth-provider`.
### Provider setup guides
To enable Google OAuth for Fleet, you need to create an OAuth client in GCP and configure it with the required URLs and credentials.
Create a new OAuth client app (Web application) in [Google Cloud Console](https://console.cloud.google.com/apis/credentials).
Add the following URLs to your OAuth client, replacing `` with your LangSmith hostname and `` with the provider ID you'll use (e.g., `google`):
**Authorized JavaScript origins:**
* `https://`
**Authorized redirect URIs:**
* `https:///api-host/v2/auth/callback/`
* `https:///host-oauth-callback/`
Copy the **Client ID** and **Client Secret** from the GCP OAuth app.
In LangSmith, go to **Settings > OAuth Providers** and add a new provider:
* **Client ID**: Find in GCP
* **Client Secret**: Find in GCP
* **Authorization URL**: `https://accounts.google.com/o/oauth2/auth`
* **Token URL**: `https://oauth2.googleapis.com/token`
* **Provider ID**: Unique string, for example: `google`
Add the LangSmith OAuth provider ID to your `values.yaml` and deploy:
```yaml theme={null}
config:
agentBuilder:
oauthProviderOrgId: ""
oauth:
googleOAuthProvider: ""
```
To enable Microsoft OAuth for Fleet, create an Azure app registration, add the required Microsoft Graph delegated permissions, and configure a Microsoft OAuth provider in LangSmith.
In the [Microsoft Entra admin center](https://entra.microsoft.com/), go to **Applications > App registrations** and create a new registration.
Select the account type that matches your deployment. If you need users from multiple Microsoft Entra tenants to authenticate, choose a multi-tenant option. If your deployment is limited to one tenant, you can use a single-tenant app registration.
Add the following web redirect URI, replacing `` with your LangSmith hostname and `` with your provider ID:
```
https:///host-oauth-callback/
```
In **Certificates & secrets**, create a new client secret. Copy the **Application (client) ID** and the generated client secret value.
In **API permissions**, add the following Microsoft Graph delegated permissions:
* `Mail.ReadWrite`
* `Mail.Send`
* `Calendars.ReadWrite`
* `Team.ReadBasic.All`
* `Channel.ReadBasic.All`
* `Channel.Create`
* `ChannelMessage.Send`
* `ChannelMessage.Read.All`
* `Chat.Create`
* `Chat.ReadWrite`
* `User.ReadBasic.All`
* `Files.ReadWrite.All`
* `Sites.ReadWrite.All`
LangSmith automatically requests `offline_access` for Microsoft providers so users can receive refresh tokens.
Grant admin consent for the tenant if your Microsoft 365 policies require it for these delegated permissions.
In LangSmith, go to **Settings > OAuth Providers** and add a new provider:
* **Name**: For example, `Microsoft`
* **Provider ID**: Unique string, for example: `microsoft-oauth-provider`
* **Client ID**: Application (client) ID from Azure
* **Client Secret**: Client secret value from Azure
* **Authorization URL**: `https://login.microsoftonline.com/common/oauth2/v2.0/authorize`
* **Token URL**: `https://login.microsoftonline.com/common/oauth2/v2.0/token`
* **Provider Type**: `microsoft`
* **Token endpoint auth method**: `client_secret_post`
If you created a single-tenant app registration, replace `common` in the authorization and token URLs with your tenant ID.
Add the following to your `values.yaml` and deploy:
```yaml theme={null}
config:
agentBuilder:
oauthProviderOrgId: ""
oauth:
microsoftOAuthProvider: ""
```
To enable Linear OAuth for Fleet, you need to create a Linear OAuth app and configure it with the required credentials.
Go to [Linear Settings > API > Applications](https://linear.app/settings/api/applications/new) and create a new OAuth application.
Set the callback URL, replacing `` with your LangSmith hostname and `` with your provider ID:
```
https:///host-oauth-callback/
```
After creating the app, copy the **Client ID** and **Client Secret**.
In LangSmith, go to **Settings > OAuth Providers** and add a new provider:
* **Client ID**: from Linear app
* **Client Secret**: from Linear app
* **Authorization URL**: `https://linear.app/oauth/authorize`
* **Token URL**: `https://api.linear.app/oauth/token`
* **Provider ID**: Unique string, for example: `linear`
Add the following to your `values.yaml` and deploy:
```yaml theme={null}
config:
agentBuilder:
oauthProviderOrgId: ""
oauth:
linearOAuthProvider: ""
```
To enable LinkedIn OAuth for Fleet, you need to create a LinkedIn OAuth app and configure it with the required credentials.
Go to [linkedin.com/developers/apps](https://www.linkedin.com/developers/apps/) and create a new app.
In your app settings, go to the **Auth** tab.
Add the following redirect URI, replacing `` with your LangSmith hostname and `` with your provider ID:
```
https:///host-oauth-callback/
```
Copy the **Client ID** and **Client Secret** from the Auth tab.
In LangSmith, go to **Settings > OAuth Providers** and add a new provider:
* **Client ID**: from LinkedIn app
* **Client Secret**: from LinkedIn app
* **Authorization URL**: `https://www.linkedin.com/oauth/v2/authorization`
* **Token URL**: `https://www.linkedin.com/oauth/v2/accessToken`
* **Provider ID**: Unique string, for example: `linkedin`
Add the following to your `values.yaml` and deploy:
```yaml theme={null}
config:
agentBuilder:
oauthProviderOrgId: ""
oauth:
linkedinOAuthProvider: ""
```
To enable Slack OAuth for Fleet, you need to create a Slack app and configure it with the required scopes, credentials, and event subscriptions.
Go to [api.slack.com/apps](https://api.slack.com/apps) and click **Create New App**.
In **OAuth & Permissions**, add the following scopes:
* `channels:history`
* `channels:read`
* `chat:write`
* `groups:history`
* `groups:read`
* `im:history`
* `im:read`
* `im:write`
* `mpim:history`
* `team:read`
* `users:read`
* `users:read.email`
Copy the **Client ID**, **Client Secret**, and **Signing Secret** from the Slack app settings.
In LangSmith, go to **Settings > OAuth Providers** and add a new provider:
* **Client ID**: Find in Slack app
* **Client Secret**: Find in Slack app
* **Authorization URL**: `https://slack.com/oauth/v2/authorize`
* **Token URL**: `https://slack.com/api/oauth.v2.access`
* **Provider ID**: Unique string, for example: `slack`
Add the following redirect URI to your Slack app under **OAuth & Permissions > Redirect URLs**, replacing `` with your LangSmith hostname and `` with your provider ID (e.g., `slack`):
```
https:///host-oauth-callback/
```
1. Get the bot token from **OAuth & Permissions** in your Slack app.
2. Run the following command:
```bash theme={null}
curl -X POST https://slack.com/api/auth.test \
-H "Authorization: Bearer "
```
3. Copy the `bot_id` from the response.
Add the following to your `values.yaml` and deploy:
```yaml theme={null}
config:
agentBuilder:
oauthProviderOrgId: ""
oauth:
slackOAuthProvider: ""
slackSigningSecret: ""
slackBotId: ""
```
1. After deployment, go to **Event Subscriptions** in your Slack app and enable events.
2. Set the **Request URL** to:
```
https:///v1/triggers/webhooks/d809e66e-0000-4000-8000-000000000002
```
3. Add the following bot events:
* `message.channels`
* `message.groups`
* `message.im`
* `message.mpim`
1. Add the Slack bot to the channel you want it to read from.
2. When configuring the Slack tool or trigger in Fleet, provide the **channel ID** and **channel name**.
## Enable GitHub App for Fleet
Fleet integrates with GitHub through a dedicated **GitHub App** (not an OAuth app). The GitHub App provides repository access for Fleet's GitHub tools and supports the user authorization flow required for private repository access.
Setup involves creating a GitHub App, gathering its credentials, storing them as Kubernetes secrets, and referencing them from `values.yaml`.
Go to [GitHub Settings > Developer settings > GitHub Apps](https://github.com/settings/apps) and click **New GitHub App**.
You can create the app under a personal account or an organization. If multiple people will manage the integration, an organization-owned app is recommended.
* **GitHub App name**: Any unique name, for example `acme-langsmith-fleet`. Make a note of the slug GitHub generates (the lowercased, hyphenated form of the name — this is the value you'll use for `FLEET_GITHUB_APP_SLUG`).
* **Homepage URL**: Your LangSmith hostname, for example `https://langsmith.acme.com`.
* Uncheck **Active** under **Webhook** for now — you'll enable it in a later step after generating a webhook secret.
Under **Identifying and authorizing users**, add the following **Callback URL**, replacing `` with your LangSmith hostname:
```
https:///v1/platform/fleet/providers/github-app/auth/callback
```
Leave **Request user authorization (OAuth) during installation** unchecked. Check **Redirect on update**.
Under **Post installation**, add the following **Setup URL**:
```
https:///v1/platform/fleet/providers/github-app/callback
```
Check **Redirect on update**.
Generate a random webhook secret:
```bash theme={null}
python3 -c "import secrets; print(secrets.token_urlsafe(48))"
```
Under **Webhook**:
* Check **Active**.
* Set the **Webhook URL** to:
```
https:///v1/platform/fleet/providers/github-app/webhooks
```
* Paste the generated value into **Webhook secret**. Save it — you'll need the same value when configuring LangSmith.
Under **Permissions > Repository permissions**, grant the following:
* **Contents**: Read and write
* **Issues**: Read and write
* **Pull requests**: Read and write
* **Metadata**: Read-only (automatically selected)
Under **Permissions > Account permissions**, grant **Email addresses: Read-only**.
These are the minimum permissions required for Fleet's built-in GitHub tools (issue management, pull request creation, repository content access). Adjust if you need additional tool capabilities.
Under **Where can this GitHub App be installed?**, select whichever option matches your distribution needs. For most self-hosted deployments, **Only on this account** is correct.
Click **Create GitHub App**. You'll be taken to the app's settings page, where several values are now available:
* **App ID** (numeric, at the top of the page) → `FLEET_GITHUB_APP_ID`
* **Public link** (for example, `https://github.com/apps/acme-langsmith-fleet`) → `FLEET_GITHUB_APP_PUBLIC_LINK`
* App slug (the last path segment of the public link) → `FLEET_GITHUB_APP_SLUG`
* **Client ID** (under **About**) → `FLEET_GITHUB_APP_CLIENT_ID`
Under **Client secrets**, click **Generate a new client secret** and copy the value. This is `FLEET_GITHUB_APP_CLIENT_SECRET`. GitHub only shows it once.
Scroll to **Private keys** and click **Generate a private key**. GitHub will download a `.pem` file. Keep this file secure — it grants full access to the GitHub App. The PEM contents are `FLEET_GITHUB_APP_PRIVATE_KEY`.
The backend signs short-lived OAuth state tokens with an HMAC key. Generate one:
```bash theme={null}
python3 -c "import secrets; print(secrets.token_urlsafe(48))"
```
This is `FLEET_GITHUB_APP_STATE_JWT_SECRET`.
Store the sensitive values in a Kubernetes secret. For example:
```bash theme={null}
kubectl create secret generic fleet-github-app \
--namespace \
--from-literal=client_secret="" \
--from-literal=webhook_secret="" \
--from-literal=state_jwt_secret="" \
--from-file=private_key=/path/to/fleet-app.private-key.pem
```
For production deployments, we recommend managing this secret through your existing secrets workflow (for example, [Sealed Secrets](https://github.com/bitnami-labs/sealed-secrets) or [External Secrets Operator](https://external-secrets.io/)). See [Use an existing secret](/langsmith/self-host-using-an-existing-secret) for more on managing LangSmith secrets.
Add the following to your `values.yaml`, replacing the placeholder values with the non-sensitive values gathered above:
```yaml theme={null}
commonEnv:
- name: FLEET_GITHUB_APP_ID
value: ""
- name: FLEET_GITHUB_APP_SLUG
value: ""
- name: FLEET_GITHUB_APP_PUBLIC_LINK
value: "https://github.com/apps/"
- name: FLEET_GITHUB_APP_CLIENT_ID
value: ""
- name: FLEET_GITHUB_APP_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: fleet-github-app
key: client_secret
- name: FLEET_GITHUB_APP_PRIVATE_KEY
valueFrom:
secretKeyRef:
name: fleet-github-app
key: private_key
- name: FLEET_GITHUB_APP_WEBHOOK_SECRET
valueFrom:
secretKeyRef:
name: fleet-github-app
key: webhook_secret
- name: FLEET_GITHUB_APP_STATE_JWT_SECRET
valueFrom:
secretKeyRef:
name: fleet-github-app
key: state_jwt_secret
agentBuilderToolServer:
deployment:
extraEnv:
- name: FLEET_GITHUB_APP_ENABLED
value: "true"
```
`FLEET_GITHUB_APP_ENABLED` must be set on the tool server so the GitHub tools are registered. The remaining `FLEET_GITHUB_APP_*` variables are consumed by the platform backend and so live under `commonEnv`.
Upgrade your LangSmith release to apply the new configuration. Once pods are healthy:
1. In LangSmith, open a Fleet agent and go to the GitHub integration in the agent editor.
2. Click **Connect GitHub** to install the app on the repositories Fleet should access.
3. For private repositories, you must explicitly select each repository during installation.
Users must also authorize the app against their own GitHub account (via the re-auth flow in LangSmith) so Fleet can resolve per-user tokens for tools that act on behalf of a user.
## Disable Fleet
To disable Fleet, set the following to `false` in your `values.yaml`:
```yaml theme={null}
config:
agentBuilder:
enabled: false
```
***
[Edit this page on GitHub](https://github.com/langchain-ai/docs/edit/main/src/langsmith/fleet/self-hosted.mdx) or [file an issue](https://github.com/langchain-ai/docs/issues/new/choose).
[Connect these docs](/use-these-docs) to Claude, VSCode, and more via MCP for real-time answers.