langfuse/langfuse · error · UnauthorizedError

Missing projectId in scope. Are you using an organization ke

Error message

Missing projectId in scope. Are you using an organization key?

What it means

The dataset run item endpoints resolve the target project from auth.scope.projectId; organization-scoped API keys have no single project, so the scope is undefined and the request is rejected as unauthorized before any data access.

Source

Thrown at web/src/features/datasets/server/publicDatasetService.ts:778

 * dataset_run_items ClickHouse table, so the full createDatasetRunItemForApi
 * flow has nothing to persist. The experiment runner still calls POST
 * /dataset-run-items per item and expects a dataset run id it can reuse as the
 * experiment id across the whole run, so we resolve the item's dataset and
 * return a stable experiment id derived from (projectId, datasetId, runName).
 *
 * In v4 the trace ↔ experiment link is established through OTel experiment span
 * attributes instead, so beyond the dataset-item lookup (needed for datasetId
 * and to 404 on genuinely missing items) we skip every legacy side effect:
 * the observation→trace lookup, ClickHouse ingestion, and the eval enqueue.
 */
export const buildStableDatasetRunItemResponseEventsOnly = async ({
  body,
  auth,
}: Pick<CreateDatasetRunItemInput, "body" | "auth">) => {
  const projectId = auth.scope.projectId;

  if (!projectId) {
    throw new UnauthorizedError(
      "Missing projectId in scope. Are you using an organization key?",
    );
  }

  const datasetItem = await getDatasetItemById({
    projectId,
    datasetItemId: body.datasetItemId,
    status: "ACTIVE",
    version: body.datasetVersion ?? undefined,
  });

  if (!datasetItem) {
    throw new LangfuseNotFoundError("Dataset item not found");
  }

  const experimentId = createStableExperimentId({
    projectId,
    datasetId: datasetItem.datasetId,

View on GitHub (pinned to 59d92c7cf3)

Solutions

1. Use a project-scoped API key (pk-org-.../sk-org-... created for a specific project) for dataset run item calls
2. If org keys must be used, route to an endpoint variant that accepts an explicit project parameter, if available
3. Check the key type in Project Settings > API Keys before wiring ingestion

if (!process.env.LANGFUSE_PUBLIC_KEY?.startsWith('pk-org-')) { /* project key ok */ } else throw new Error('Use a project-scoped key for dataset-run-items');

When it happens

Trigger: POST /api/public/dataset-run-items using an organization-level API key (pk-org-.../sk-org-...) instead of a project-scoped key.

Common situations: Adopting the new org key format and reusing it for dataset ingestion; CI scripts updated to org keys while the SDK endpoint still requires a project.

Related errors

• ${authCheck.error}
• Unauthorized: Cannot use organization key with bearer auth
• Access denied: Bearer auth and org api keys are not allowed
• Access denied - need to use basic auth with secret key to ${
• No valid projectId found for auth token

AI-assisted analysis of langfuse/langfuse@59d92c7cf3 (2026-08-27). Data as JSON: /api/errors/b63df646cbdbd022. Report an issue: GitHub.