Analytics

This guide walks you through enabling Laminar in Faheem Code Enterprise (FCE) so conversations automatically send traces for observability and analysis.

For SDK-level tracing concepts, OTEL environment variables, and non-Laminar backends, see Observability & Tracing.

Who this is for

This guide is for users who want to deploy Laminar alongside Faheem Code Enterprise and inspect traces from Enterprise conversations.

Why Laminar in FCE?

Laminar helps you understand what your Faheem Code deployment is doing in production:

• Inspect prompts, tool calls, answers, and nested agent behavior in Laminar's trace views.
• Use session replay for browser agents when conversations drive browser automation.
• For Helm installs, define signals to classify failures, measure outcomes, and monitor recurring patterns across many traces.

For more information on evaluating skills, see Evaluating Agent Skills.

Prerequisites

Before you begin, complete the Quick Start guide.

Enable analytics

Info

VM installs currently support trace collection, but do not support Laminar signals. The Admin Console configures the Laminar Project API Key only; the installer sets the remaining Laminar connection values automatically.

You should see an Analytics Configuration section on the application configuration page.

Check the Enable Analytics box to have the installer set up and configure Laminar for analytics.

Screenshot: Configure Analytics.

If you deployed Faheem Code Enterprise into your own Kubernetes cluster using Helm, enable Laminar in your values.yaml override file.

laminar:
  enabled: true
  global:
    # Set to "aws" or "gcp" to match your cluster.
    cloudProvider: "aws"

  frontend:
    ingress:
      enabled: true
      hostname: "analytics.<your-base-domain>"
      tls:
        enabled: true
        secretName: "laminar-frontend-tls"
    env:
      # Must equal the frontend hostname above; the Keycloak callback URL is derived from it.
      nextauthUrl: "https://analytics.<your-base-domain>"
      nextPublicUrl: "https://analytics.<your-base-domain>"
    extraEnv:
      - name: AUTH_KEYCLOAK_ID
        valueFrom:
          secretKeyRef:
            name: keycloak-realm
            key: client-id
      - name: AUTH_KEYCLOAK_SECRET
        valueFrom:
          secretKeyRef:
            name: keycloak-realm
            key: client-secret
      - name: AUTH_KEYCLOAK_ISSUER
        value: "https://auth.<your-base-domain>/realms/faheemcode"

  appServer:
    # Use an app-server ingress on GCP or other L7 ingress setups.
    ingress:
      enabled: true
      hostname: "laminar-api.<your-base-domain>"
      tls:
        enabled: true
        secretName: "laminar-app-server-tls"

    # On AWS, use a Network Load Balancer instead of appServer.ingress
    # if your runtimes send traces directly over TCP.
    loadBalancer:
      enabled: false

Keep laminar.enabled: false until your ingress, TLS, and storage class settings match your cluster.

Deploy

Faheem Code will begin deploying. You can expect the deployment status to transition from Missing to Unavailable to Ready. This typically takes 10-15 minutes.

Screenshot: Deployment in progress.

Click Details next to the deployment status to monitor individual resources. Resources shown in orange are still deploying, so wait until all resources are ready.

Screenshot: Deployment status details.

Apply your updated values.yaml override file:

helm upgrade faheemcode oci://registry.replicated.com/faheemcode/faheemcode \
  --namespace faheemcode \
  --values values.yaml

Wait for the Laminar workloads, ingress, and TLS resources to become ready.

Access the Laminar UI

Once the deployment status shows Ready, navigate to the Laminar frontend URL:

• VM install: https://analytics.<your-base-domain>
• Kubernetes install: the hostname configured in laminar.frontend.ingress.hostname

Click the Continue with Keycloak button:

Screenshot: Laminar Keycloak Auth.

Note

For the Continue with Keycloak flow to succeed, the Keycloak client referenced by the keycloak-realm Secret must allow the Laminar callback. Its Valid Redirect URIs must include https://analytics.<your-base-domain>/api/auth/callback/keycloak and its Web Origins must include https://analytics.<your-base-domain>.

These must match the hostname in laminar.frontend.ingress.hostname. If your DNS uses the simple (single-level) layout — for example analytics.<your-base-domain> rather than a nested analytics.app.<your-base-domain> — confirm the redirect URI matches that hostname exactly, otherwise Keycloak rejects the login with an Invalid parameter: redirect_uri error.

If you want more background on Laminar Cloud versus self-hosting outside FCE, see Laminar's official hosting options.

Create a Laminar project

Create a project in the Laminar UI:

Screenshot: Laminar Create Project.

Once a project has been created, Laminar is ready to listen for traces.

Screenshot: Laminar Listen Traces.

Create an ingest-only API key

Always use ingest-only API keys when deploying FCE.

Ingest-only keys are recommended because FCE only needs permission to write traces. They cannot be used to read trace data.

Screenshot: Configure Laminar Ingest Only Key.

Set the Laminar project API key

This is the same LMNR_PROJECT_API_KEY described in the SDK observability guide.

Set the ingest-only key as the Laminar Project API Key in the Admin Console configuration.

Screenshot: Configure Laminar Project API Key.

Click Save config.

Create a Kubernetes Secret for the ingest-only project key:

kubectl create secret generic lmnr-project-api-key \
  --namespace faheemcode \
  --from-literal=LMNR_PROJECT_API_KEY=<your-ingest-only-key>

Create a Secret for the Laminar app-server base URL:

kubectl create secret generic lmnr-base-url \
  --namespace faheemcode \
  --from-literal=LMNR_BASE_URL=https://laminar-api.<your-base-domain>

Then reference those Secrets from your values.yaml override file:

laminar:
  enabled: true
  apiKeyFromSecret:
    name: lmnr-project-api-key
    key: LMNR_PROJECT_API_KEY
  baseUrlFromSecret:
    name: lmnr-base-url
    key: LMNR_BASE_URL
  forceHttp: true

If your self-hosted Laminar app server exposes a non-default HTTP port, set laminar.httpPort.

Configure runtime environment variables

VM installs configure analytics through the Admin Console. After analytics is enabled and the Laminar Project API Key is saved, the installer automatically configures:

LMNR_BASE_URL: "http://laminar-app-server-service"
LMNR_PROJECT_API_KEY: "<your-ingest-only-key>"
LMNR_FORCE_HTTP: "true"
LMNR_HTTP_PORT: "8000"

The Admin Console does not currently expose LLM_* settings for Laminar AI features. VM installs currently send traces to Laminar, but do not support Laminar signals.

In FCE, environment variables whose names start with LMNR_ or LLM_ are forwarded to the SDK runtime. This lets you configure Laminar ingestion settings and the LLM settings used for Laminar-backed workflows.

For example, you can point the runtime at the managed Laminar endpoint and use an ingest-only project key:

LMNR_BASE_URL: "https://laminar-api.<your-base-domain>"
# Ingest-only API key, not a read-capable secret:
LMNR_PROJECT_API_KEY: ""
LMNR_FORCE_HTTP: "true"

The chart sets LMNR_PROJECT_API_KEY, LMNR_BASE_URL, LMNR_FORCE_HTTP, and LMNR_HTTP_PORT from the laminar values above. If you need to override one of them directly, set it under the top-level env values in your values.yaml.

You can also control which LLM Laminar uses for its AI features — chat-with-trace, SQL-with-AI, and signals — by forwarding the standard LLM_* variables. Add these values under the top-level env values:

env:
  LLM_PROVIDER: "openai"
  LLM_API_KEY: "<your-openai-or-gateway-key>"
  LLM_BASE_URL: "https://llm-proxy.<your-base-domain>"
  LLM_MODEL_SMALL: "gpt-5.4-mini"
  LLM_MODEL_MEDIUM: "gpt-5.4-mini"
  LLM_MODEL_LARGE: "gpt-5.5"

LLM_PROVIDER accepts gemini (Laminar's default), openai, or bedrock, and LLM_MODEL_SMALL / LLM_MODEL_MEDIUM / LLM_MODEL_LARGE are optional per-tier model overrides. Set LLM_PROVIDER to openai whenever you point LLM_BASE_URL at an OpenAI-compatible gateway (for example LiteLLM, OpenRouter, or vLLM), not just the public OpenAI API. Set LLM_API_KEY for gemini, openai, and OpenAI-compatible gateways; use AWS credentials instead for bedrock.

For the full set of supported values, see Laminar's official self-hosting configuration reference.

Deploy updated configuration

Deploy the configuration change after setting the Laminar Project API Key.

Click Deploy in the Admin Console.

Screenshot: Laminar Deploy Again.

For a VM install walkthrough, watch the recap:

Apply your updated values.yaml override file:

helm upgrade faheemcode oci://registry.replicated.com/faheemcode/faheemcode \
  --namespace faheemcode \
  --values values.yaml

Wait for the deployment to complete.

Start a conversation

Navigate to the Faheem Code UI at https://app.<your-base-domain>. Start a new conversation and try a prompt.

Screenshot: Start a Conversation.

Your conversations will now automatically send traces to Laminar.

Screenshot: Laminar Trace.

What to do next in Laminar

Once traces are flowing, use Laminar's official docs to go deeper:

• Viewing Traces to inspect a single conversation in transcript, tree, or timeline views.
• For Helm installs, Signals to extract structured outcomes or failure modes across many traces.
• Session replay for browser agents to debug browser-based automations.
• Observability for Faheem Code SDK for the Faheem Code-specific tracing model.

Next steps

Observability & tracing

Learn the full Faheem Code tracing model, OTEL configuration options, and non-Laminar backends.

Prompting best practices

Get more reliable traces by improving the prompts you give your agents.

Contact support

Reach out to the Faheem Code team for deployment assistance or questions.