Description

We're implementing a webhook endpoint to receive dataset experiment triggers from the Langfuse UI using the "Remote Dataset Run" feature (documented under "Experiments via SDK > Optional: Trigger SDK Experiment from UI").

Question: What's the recommended way to authenticate and secure these webhook requests?

What we've observed

• Configured webhook URL in Langfuse UI (Settings > Dataset > Remote Experiment)
• Incoming webhook requests don't include Authorization headers
• No visible option in the UI to configure custom headers
• Requests arrive successfully but we can't verify they're actually from Langfuse

What we need

A way to verify that incoming webhook requests are legitimately from Langfuse and not from unauthorized sources. This is important for securing production endpoints.

• Does Langfuse currently support any authentication method for Remote Dataset Run webhooks?
• If not, what's the recommended approach for securing these endpoints?
• Are there plans to add authentication support in the future?
• Is there existing functionality we might have missed in the documentation?

Any guidance would be appreciated. Thanks!