Manage Fleet

LangSmith Fleet allows users to create, deploy, and manage AI agents directly within LangSmith with no code. An agent created in Fleet is essentially an assistant on a LangSmith Deployment. This page explains how to manage Fleet on a self-hosted LangSmith instance.

Fleet traces all agent runs and stores them in LangSmith. Self-hosted customers can disable tracing but run data is always stored in LangSmith Deployment. Configure retention policies according to your organization’s requirements.

Prerequisites

Before enabling Fleet, you must complete the following setup steps:

1. Install the base LangSmith platform:
   • Install on Kubernetes.
   • Install on Docker.
2. Enable LangSmith Deployment (agent deployment capabilities).

Fleet is available on LangSmith Self-Hosted v0.13 and later. Self-hosted is an add-on to the Enterprise plan. For more details, refer to Pricing. Contact our sales team if you want to get a license key to trial LangSmith in your environment.

Components

Fleet consists of the following components:

• agentBootstrap: Job that deploys the LangSmith Deployment (agent) needed for Fleet.
• agentBuilder
  • toolServer: Provides MCP tool execution for agents.
  • triggerServer: Handles webhooks and scheduled triggers.
  • agent: The main agent that will handle agent generation and where all the assistants will be created.

Enable Fleet

To enable Fleet, add the following to your values.yaml:

backend:
  agentBootstrap:
    enabled: true

config:
  agentBuilder:
    enabled: true
    encryptionKey: "<key>"

agentBuilderToolServer:
  enabled: true

agentBuilderTriggerServer:
  enabled: true

Generate an encryption key

Fleet requires a Fernet encryption key to securely store secrets. Generate one using Python:

python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"

You can store the encryption key in a predefined Kubernetes secret using the fleet_encryption_key parameter. See Use an existing secret for details.

Enable OAuth tools and triggers (optional)

To enable OAuth-based tools (like Gmail, Slack, Linear), configure the oauthProviderOrgId and add provider IDs for each integration you want to enable. You can enable any combination of providers.

GitHub tools are no longer configured through an OAuth provider. Fleet now integrates with GitHub via a dedicated GitHub App. See Enable GitHub App for Fleet below.

Available providers

Provider	Tools enabled	Trigger enabled	Setup guide
googleOAuthProvider	Gmail, Google Calendar, Google Sheets, BigQuery	Gmail	See below
linearOAuthProvider	Linear	-	See below
linkedinOAuthProvider	LinkedIn	-	See below
microsoftOAuthProvider	Outlook, Calendar, Teams, SharePoint, Word, Excel, PowerPoint	Outlook	See below
slackOAuthProvider	Slack	Slack	See below

General configuration

Add the following to your values.yaml. Include only the providers you need.

backend:
  agentBootstrap:
    enabled: true

config:
  agentBuilder:
    # Organization ID where OAuth providers are configured
    oauthProviderOrgId: "<your-org-id>"
    oauth:
      # Add provider IDs for integrations you want to enable,
      # Slack requires additional configuration
      slackOAuthProvider: "<provider-id>"
      slackSigningSecret: "<signing-secret>"
      slackBotId: "<bot-id>"
      googleOAuthProvider: "<provider-id>"
      linkedinOAuthProvider: "<provider-id>"
      linearOAuthProvider: "<provider-id>"
      microsoftOAuthProvider: "<provider-id>"

The provider ID must be unique and cannot end with -agent-builder or -oauth-provider.

Provider setup guides

Google OAuth provider

To enable Google OAuth for Fleet, you need to create an OAuth client in GCP and configure it with the required URLs and credentials.

1. Create OAuth client in GCP

   Create a new OAuth client app (Web application) in Google Cloud Console.

2. Add URLs to GCP

   Add the following URLs to your OAuth client, replacing <hostname> with your LangSmith hostname and <provider-id> with the provider ID you’ll use (e.g., google):

   Authorized JavaScript origins:

   • https://<hostname>

   Authorized redirect URIs:

   • https://<hostname>/api-host/v2/auth/callback/<provider-id>
   • https://<hostname>/host-oauth-callback/<provider-id>
3. Copy credentials

   Copy the Client ID and Client Secret from the GCP OAuth app.

4. Configure OAuth provider in LangSmith

   In LangSmith, go to Settings > OAuth Providers and add a new provider:

   • Client ID: Find in GCP
   • Client Secret: Find in GCP
   • Authorization URL: https://accounts.google.com/o/oauth2/auth
   • Token URL: https://oauth2.googleapis.com/token
   • Provider ID: Unique string, for example: google
5. Deploy

   Add the LangSmith OAuth provider ID to your values.yaml and deploy:

   config:
     agentBuilder:
       oauthProviderOrgId: "<your-org-id>"
       oauth:
         googleOAuthProvider: "<provider-id>"
   

Microsoft OAuth provider

To enable Microsoft OAuth for Fleet, create an Azure app registration, add the required Microsoft Graph delegated permissions, and configure a Microsoft OAuth provider in LangSmith.

1. Create an Azure app registration

   In the Microsoft Entra admin center, go to Applications > App registrations and create a new registration.

2. Choose supported account types

   Select the account type that matches your deployment. If you need users from multiple Microsoft Entra tenants to authenticate, choose a multi-tenant option. If your deployment is limited to one tenant, you can use a single-tenant app registration.

3. Add the redirect URI

   Add the following web redirect URI, replacing <hostname> with your LangSmith hostname and <provider-id> with your provider ID:

   https://<hostname>/host-oauth-callback/<provider-id>
   
4. Create a client secret

   In Certificates & secrets, create a new client secret. Copy the Application (client) ID and the generated client secret value.

5. Add Microsoft Graph delegated permissions

   In API permissions, add the following Microsoft Graph delegated permissions:

   • Mail.ReadWrite
   • Mail.Send
   • Calendars.ReadWrite
   • Team.ReadBasic.All
   • Channel.ReadBasic.All
   • Channel.Create
   • ChannelMessage.Send
   • ChannelMessage.Read.All
   • Chat.Create
   • Chat.ReadWrite
   • User.ReadBasic.All
   • Files.ReadWrite.All
   • Sites.ReadWrite.All

   LangSmith automatically requests offline_access for Microsoft providers so users can receive refresh tokens.

6. Grant tenant consent

   Grant admin consent for the tenant if your Microsoft 365 policies require it for these delegated permissions.

7. Configure OAuth provider in LangSmith

   In LangSmith, go to Settings > OAuth Providers and add a new provider:

   • Name: For example, Microsoft
   • Provider ID: Unique string, for example: microsoft-oauth-provider
   • Client ID: Application (client) ID from Azure
   • Client Secret: Client secret value from Azure
   • Authorization URL: https://login.microsoftonline.com/common/oauth2/v2.0/authorize
   • Token URL: https://login.microsoftonline.com/common/oauth2/v2.0/token
   • Provider Type: microsoft
   • Token endpoint auth method: client_secret_post

   If you created a single-tenant app registration, replace common in the authorization and token URLs with your tenant ID.

8. Deploy

   Add the following to your values.yaml and deploy:

   config:
     agentBuilder:
       oauthProviderOrgId: "<your-org-id>"
       oauth:
         microsoftOAuthProvider: "<provider-id>"
   

Linear OAuth provider

To enable Linear OAuth for Fleet, you need to create a Linear OAuth app and configure it with the required credentials.

1. Create a Linear OAuth app

   Go to Linear Settings > API > Applications and create a new OAuth application.

2. Add callback URL

   Set the callback URL, replacing <hostname> with your LangSmith hostname and <provider-id> with your provider ID:

   https://<hostname>/host-oauth-callback/<provider-id>
   
3. Copy credentials

   After creating the app, copy the Client ID and Client Secret.

4. Configure OAuth provider in LangSmith

   In LangSmith, go to Settings > OAuth Providers and add a new provider:

   • Client ID: from Linear app
   • Client Secret: from Linear app
   • Authorization URL: https://linear.app/oauth/authorize
   • Token URL: https://api.linear.app/oauth/token
   • Provider ID: Unique string, for example: linear
5. Deploy

   Add the following to your values.yaml and deploy:

   config:
     agentBuilder:
       oauthProviderOrgId: "<your-org-id>"
       oauth:
         linearOAuthProvider: "<provider-id>"
   

LinkedIn OAuth provider

To enable LinkedIn OAuth for Fleet, you need to create a LinkedIn OAuth app and configure it with the required credentials.

1. Create a LinkedIn OAuth app

   Go to linkedin.com/developers/apps and create a new app.

2. Configure OAuth settings

   In your app settings, go to the Auth tab.

3. Add redirect URI

   Add the following redirect URI, replacing <hostname> with your LangSmith hostname and <provider-id> with your provider ID:

   https://<hostname>/host-oauth-callback/<provider-id>
   
4. Copy credentials

   Copy the Client ID and Client Secret from the Auth tab.

5. Configure OAuth provider in LangSmith

   In LangSmith, go to Settings > OAuth Providers and add a new provider:

   • Client ID: from LinkedIn app
   • Client Secret: from LinkedIn app
   • Authorization URL: https://www.linkedin.com/oauth/v2/authorization
   • Token URL: https://www.linkedin.com/oauth/v2/accessToken
   • Provider ID: Unique string, for example: linkedin
6. Deploy

   Add the following to your values.yaml and deploy:

   config:
     agentBuilder:
       oauthProviderOrgId: "<your-org-id>"
       oauth:
         linkedinOAuthProvider: "<provider-id>"
   

Slack OAuth provider

To enable Slack OAuth for Fleet, you need to create a Slack app and configure it with the required scopes, credentials, and event subscriptions.

1. Create a Slack app

   Go to api.slack.com/apps and click Create New App.

2. Add scopes

   In OAuth & Permissions, add the following scopes:

   • channels:history
   • channels:read
   • chat:write
   • groups:history
   • groups:read
   • im:history
   • im:read
   • im:write
   • mpim:history
   • team:read
   • users:read
   • users:read.email
3. Copy credentials from Slack

   Copy the Client ID, Client Secret, and Signing Secret from the Slack app settings.

4. Configure OAuth provider in LangSmith

   In LangSmith, go to Settings > OAuth Providers and add a new provider:

   • Client ID: Find in Slack app
   • Client Secret: Find in Slack app
   • Authorization URL: https://slack.com/oauth/v2/authorize
   • Token URL: https://slack.com/api/oauth.v2.access
   • Provider ID: Unique string, for example: slack
5. Add redirect URI to Slack

   Add the following redirect URI to your Slack app under OAuth & Permissions > Redirect URLs, replacing <hostname> with your LangSmith hostname and <provider-id> with your provider ID (e.g., slack):

   https://<hostname>/host-oauth-callback/<provider-id>
   
6. Get the bot ID

   1. Get the bot token from OAuth & Permissions in your Slack app.
   2. Run the following command:

   curl -X POST https://slack.com/api/auth.test \
     -H "Authorization: Bearer <bot-token>"
   

   3. Copy the bot_id from the response.
7. Deploy LangSmith

   Add the following to your values.yaml and deploy:

   config:
     agentBuilder:
       oauthProviderOrgId: "<your-org-id>"
       oauth:
         slackOAuthProvider: "<provider-id>"
         slackSigningSecret: "<signing-secret>"
         slackBotId: "<bot-id>"
   
8. Enable event subscriptions

   1. After deployment, go to Event Subscriptions in your Slack app and enable events.

   2. Set the Request URL to:

      https://<hostname>/v1/triggers/webhooks/d809e66e-0000-4000-8000-000000000002
      

   3. Add the following bot events:

      • message.channels
      • message.groups
      • message.im
      • message.mpim
9. Set up triggers and tools

   1. Add the Slack bot to the channel you want it to read from.
   2. When configuring the Slack tool or trigger in Fleet, provide the channel ID and channel name.

Enable GitHub App for Fleet

Fleet integrates with GitHub through a dedicated GitHub App (not an OAuth app). The GitHub App provides repository access for Fleet’s GitHub tools and supports the user authorization flow required for private repository access.

Setup involves creating a GitHub App, gathering its credentials, storing them as Kubernetes secrets, and referencing them from values.yaml.

1. Create a GitHub App

   Go to GitHub Settings > Developer settings > GitHub Apps and click New GitHub App.

   You can create the app under a personal account or an organization. If multiple people will manage the integration, an organization-owned app is recommended.

2. Fill in basic details

   • GitHub App name: Any unique name, for example acme-langsmith-fleet. Make a note of the slug GitHub generates (the lowercased, hyphenated form of the name — this is the value you’ll use for FLEET_GITHUB_APP_SLUG).
   • Homepage URL: Your LangSmith hostname, for example https://langsmith.acme.com.
   • Uncheck Active under Webhook for now — you’ll enable it in a later step after generating a webhook secret.
3. Set callback URLs

   Under Identifying and authorizing users, add the following Callback URL, replacing <hostname> with your LangSmith hostname:

   https://<hostname>/v1/platform/fleet/providers/github-app/auth/callback
   

   Leave Request user authorization (OAuth) during installation unchecked. Check Redirect on update.

   Under Post installation, add the following Setup URL:

   https://<hostname>/v1/platform/fleet/providers/github-app/callback
   

   Check Redirect on update.

4. Set webhook URL and generate a webhook secret

   Generate a random webhook secret:

   python3 -c "import secrets; print(secrets.token_urlsafe(48))"
   

   Under Webhook:

   • Check Active.

   • Set the Webhook URL to:

     https://<hostname>/v1/platform/fleet/providers/github-app/webhooks
     

   • Paste the generated value into Webhook secret. Save it — you’ll need the same value when configuring LangSmith.

5. Set repository permissions

   Under Permissions > Repository permissions, grant the following:

   • Contents: Read and write
   • Issues: Read and write
   • Pull requests: Read and write
   • Metadata: Read-only (automatically selected)

   Under Permissions > Account permissions, grant Email addresses: Read-only.

   These are the minimum permissions required for Fleet’s built-in GitHub tools (issue management, pull request creation, repository content access). Adjust if you need additional tool capabilities.

6. Choose install visibility

   Under Where can this GitHub App be installed?, select whichever option matches your distribution needs. For most self-hosted deployments, Only on this account is correct.

7. Create the app

   Click Create GitHub App. You’ll be taken to the app’s settings page, where several values are now available:

   • App ID (numeric, at the top of the page) → FLEET_GITHUB_APP_ID
   • Public link (for example, https://github.com/apps/acme-langsmith-fleet) → FLEET_GITHUB_APP_PUBLIC_LINK
   • App slug (the last path segment of the public link) → FLEET_GITHUB_APP_SLUG
   • Client ID (under About) → FLEET_GITHUB_APP_CLIENT_ID
8. Generate a client secret

   Under Client secrets, click Generate a new client secret and copy the value. This is FLEET_GITHUB_APP_CLIENT_SECRET. GitHub only shows it once.

9. Generate a private key

   Scroll to Private keys and click Generate a private key. GitHub will download a .pem file. Keep this file secure — it grants full access to the GitHub App. The PEM contents are FLEET_GITHUB_APP_PRIVATE_KEY.

10. Generate a state JWT secret

    The backend signs short-lived OAuth state tokens with an HMAC key. Generate one:

    python3 -c "import secrets; print(secrets.token_urlsafe(48))"
    

    This is FLEET_GITHUB_APP_STATE_JWT_SECRET.

11. Create a Kubernetes secret

    Store the sensitive values in a Kubernetes secret. For example:

    kubectl create secret generic fleet-github-app \
      --namespace <your-langsmith-namespace> \
      --from-literal=client_secret="<client-secret>" \
      --from-literal=webhook_secret="<webhook-secret>" \
      --from-literal=state_jwt_secret="<state-jwt-secret>" \
      --from-file=private_key=/path/to/fleet-app.private-key.pem
    

    For production deployments, we recommend managing this secret through your existing secrets workflow (for example, Sealed Secrets or External Secrets Operator). See Use an existing secret for more on managing LangSmith secrets.

12. Configure values.yaml

    Add the following to your values.yaml, replacing the placeholder values with the non-sensitive values gathered above:

    commonEnv:
      - name: FLEET_GITHUB_APP_ID
        value: "<app-id>"
      - name: FLEET_GITHUB_APP_SLUG
        value: "<app-slug>"
      - name: FLEET_GITHUB_APP_PUBLIC_LINK
        value: "https://github.com/apps/<app-slug>"
      - name: FLEET_GITHUB_APP_CLIENT_ID
        value: "<client-id>"
      - name: FLEET_GITHUB_APP_CLIENT_SECRET
        valueFrom:
          secretKeyRef:
            name: fleet-github-app
            key: client_secret
      - name: FLEET_GITHUB_APP_PRIVATE_KEY
        valueFrom:
          secretKeyRef:
            name: fleet-github-app
            key: private_key
      - name: FLEET_GITHUB_APP_WEBHOOK_SECRET
        valueFrom:
          secretKeyRef:
            name: fleet-github-app
            key: webhook_secret
      - name: FLEET_GITHUB_APP_STATE_JWT_SECRET
        valueFrom:
          secretKeyRef:
            name: fleet-github-app
            key: state_jwt_secret
    
    agentBuilderToolServer:
      deployment:
        extraEnv:
          - name: FLEET_GITHUB_APP_ENABLED
            value: "true"
    

    FLEET_GITHUB_APP_ENABLED must be set on the tool server so the GitHub tools are registered. The remaining FLEET_GITHUB_APP_* variables are consumed by the platform backend and so live under commonEnv.

13. Deploy and install the app on repositories

    Upgrade your LangSmith release to apply the new configuration. Once pods are healthy:

    1. In LangSmith, open a Fleet agent and go to the GitHub integration in the agent editor.
    2. Click Connect GitHub to install the app on the repositories Fleet should access.
    3. For private repositories, you must explicitly select each repository during installation.

    Users must also authorize the app against their own GitHub account (via the re-auth flow in LangSmith) so Fleet can resolve per-user tokens for tools that act on behalf of a user.

Disable Fleet

To disable Fleet, set the following to false in your values.yaml:

config:
    agentBuilder:
        enabled: false

---

Edit this page on GitHub or file an issue.

Connect these docs to Claude, VSCode, and more via MCP for real-time answers.