feat(langgraph+lsd): custom encryption at rest #1715

cwlbraa · 2025-12-02T22:54:45Z

Overview

This PR documents new SDK annotations for injecting custom encryption at rest handlers in langsmith deployments.

Type of change

Type: New documentation page

Related issues/PRs

langchain-ai/langgraph#6482
https://github.com/langchain-ai/langgraph-api/pull/1773

Linear issue: LSD-172
Slack thread:

Checklist

I have read the contributing guidelines
I have tested my changes locally using docs dev
All code examples have been tested and work correctly
- AWS example was tested against localstack
- both were tested without a real langgraph-server but are similar enough to the custom_encryption.py test graph that we should be safe.
I have used root relative paths for internal links
I have updated navigation in src/docs.json if needed

(Internal team members only / optional): Create a preview deployment as necessary using the Create Preview Branch workflow

Additional notes

Signed-off-by: Connor Braa <cwlbraa@langchain.dev>

github-actions · 2025-12-02T22:56:41Z

Mintlify preview ID generated: preview-cwlbra-1764716167-f54d181

src/langsmith/custom-encryption.mdx

Signed-off-by: Connor Braa <cwlbraa@langchain.dev>

github-actions · 2025-12-03T20:12:27Z

Mintlify preview ID generated: preview-cwlbra-1764792719-f87b160

Signed-off-by: Connor Braa <cwlbraa@langchain.dev>

github-actions · 2025-12-03T20:48:06Z

Mintlify preview ID generated: preview-cwlbra-1764794852-f512487

Signed-off-by: Connor Braa <cwlbraa@langchain.dev>

github-actions · 2025-12-03T21:35:36Z

Mintlify preview ID generated: preview-cwlbra-1764797703-084c32f

Signed-off-by: Connor Braa <cwlbraa@langchain.dev>

github-actions · 2025-12-03T21:45:11Z

Mintlify preview ID generated: preview-cwlbra-1764798277-4b07aa7

Signed-off-by: Connor Braa <cwlbraa@langchain.dev>

github-actions · 2025-12-04T00:53:57Z

Mintlify preview ID generated: preview-cwlbra-1764809607-03baa36

jdrogers940

Nice! These docs look really good. Proposed some high level restructuring but content and examples themselves look awesome.

src/langsmith/custom-encryption.mdx

Signed-off-by: Connor Braa <cwlbraa@langchain.dev>

github-actions · 2025-12-04T19:25:40Z

Mintlify preview ID generated: preview-cwlbra-1764876311-58b2b83

Signed-off-by: Connor Braa <cwlbraa@langchain.dev>

github-actions · 2025-12-04T19:29:21Z

Mintlify preview ID generated: preview-cwlbra-1764876531-3e7042f

jdrogers940 · 2025-12-04T20:18:17Z

src/langsmith/encryption.mdx

+sidebarTitle: Encryption at-rest
+---
+
+LangGraph Platform supports encryption at-rest for checkpoint data and metadata. You can choose between basic encryption with a single key or custom encryption for advanced use cases.


Suggested change

LangGraph Platform supports encryption at-rest for checkpoint data and metadata. You can choose between basic encryption with a single key or custom encryption for advanced use cases.

Agent Server supports encryption at-rest for checkpoint data and metadata. You can choose between basic encryption with a single key or custom encryption for advanced use cases.

jdrogers940 · 2025-12-04T20:19:04Z

src/langsmith/encryption.mdx

+LangGraph Platform supports encryption at-rest for checkpoint data and metadata. You can choose between basic encryption with a single key or custom encryption for advanced use cases.
+
+<Note>
+Encryption at-rest is available for LangGraph Platform deployments (Python graphs only).


nit: This is in the Deployments section so I would just call out the python piece. Also the API version needed similar to here: https://docs.langchain.com/langsmith/custom-lifespan#how-to-add-custom-lifespan-events

jdrogers940 · 2025-12-04T20:20:36Z

src/langsmith/encryption.mdx

+| Method | What's encrypted | Use case |
+|--------|------------------|----------|
+| **Basic encryption** | Checkpoint blobs only | Single static key, automatic AES encryption |
+| **Custom encryption** | Checkpoints + JSON fields | Per-tenant keys, KMS integration, selective field encryption |


the "metadata" ambiguity is brutal. i think naming the models, as you've suggested, instead of naming the fields is probably best here, but it's also annoyingly vague.

Signed-off-by: Connor Braa <cwlbraa@langchain.dev>

github-actions · 2025-12-04T23:29:36Z

Mintlify preview ID generated: preview-cwlbra-1764890947-a18454a

**Description:** This PR adds the Python SDK types necessary for langgraph platform users to inject their own custom encryption-at-rest functions. See [docs PR](langchain-ai/docs#1715) for more details. note: this PR adds a starlette dev dependency so that custom encryption can access BaseUser information. **Issue:** required for LSD-172 **Dependencies:** - [depended upon by associated langgraph-api changes](langchain-ai/langgraph-api#1773 PR must merge before that one) - [docs PR](langchain-ai/docs#1715) **TODO:** - [x] move docs to docs repo - [x] bump package versions before merge --------- Signed-off-by: Connor Braa <cwlbraa@langchain.dev> Co-authored-by: Claude <noreply@anthropic.com>

katmayb

lgtm from a docs pov, just need to make sure to update the references to LGP.

katmayb · 2025-12-08T17:35:54Z

src/langsmith/encryption.mdx

+LangGraph Platform supports encryption at-rest for checkpoint data and metadata. You can choose between basic encryption with a single key or custom encryption for advanced use cases.
+
+<Note>
+Encryption at-rest is available for LangGraph Platform deployments (Python graphs only).


Suggested change

Encryption at-rest is available for LangGraph Platform deployments (Python graphs only).

Encryption at-rest is available for Agent Server deployments (Python graphs only).

Or LangSmith deployments?

feat(langraph+lsd): custom encryption at rest

87dd364

Signed-off-by: Connor Braa <cwlbraa@langchain.dev>

cwlbraa requested review from katmayb and lnhsingh as code owners December 2, 2025 22:54

github-actions bot added the langsmith For docs changes to LangSmith label Dec 2, 2025

cwlbraa mentioned this pull request Dec 2, 2025

feat: custom encryption at rest langchain-ai/langgraph#6482

Merged

2 tasks

cwlbraa requested review from hinthornw and jdrogers940 December 2, 2025 23:23

cwlbraa changed the title ~~feat(langraph+lsd): custom encryption at rest~~ feat(langgraph+lsd): custom encryption at rest Dec 2, 2025

hinthornw reviewed Dec 3, 2025

View reviewed changes

src/langsmith/custom-encryption.mdx Outdated Show resolved Hide resolved

hinthornw reviewed Dec 3, 2025

View reviewed changes

src/langsmith/custom-encryption.mdx Outdated Show resolved Hide resolved

hinthornw reviewed Dec 3, 2025

View reviewed changes

src/langsmith/custom-encryption.mdx Outdated Show resolved Hide resolved

hinthornw reviewed Dec 3, 2025

View reviewed changes

src/langsmith/custom-encryption.mdx Outdated Show resolved Hide resolved

hinthornw reviewed Dec 3, 2025

View reviewed changes

src/langsmith/custom-encryption.mdx Outdated Show resolved Hide resolved

hinthornw reviewed Dec 3, 2025

View reviewed changes

src/langsmith/custom-encryption.mdx Outdated Show resolved Hide resolved

full rework of examples

096e36a

Signed-off-by: Connor Braa <cwlbraa@langchain.dev>

warning regarding migration

0afab9e

Signed-off-by: Connor Braa <cwlbraa@langchain.dev>

update with __encrypted__ approach for migration

03be1c8

Signed-off-by: Connor Braa <cwlbraa@langchain.dev>

user[tenant_id]

afc19e2

Signed-off-by: Connor Braa <cwlbraa@langchain.dev>

polish list of fields to leave unencrypted

c7ee0d8

Signed-off-by: Connor Braa <cwlbraa@langchain.dev>

cwlbraa force-pushed the cwlbraa/custom-encryption-LSD-172 branch from 3333def to c7ee0d8 Compare December 4, 2025 00:49

jdrogers940 reviewed Dec 4, 2025

View reviewed changes

address josh's comments

37fbc1d

Signed-off-by: Connor Braa <cwlbraa@langchain.dev>

fix what gets encrypted header nesting

6781cbd

Signed-off-by: Connor Braa <cwlbraa@langchain.dev>

jdrogers940 reviewed Dec 4, 2025

View reviewed changes

document aes->custom migration behavior

35cd9e2

Signed-off-by: Connor Braa <cwlbraa@langchain.dev>

katmayb reviewed Dec 8, 2025

View reviewed changes

	LangGraph Platform supports encryption at-rest for checkpoint data and metadata. You can choose between basic encryption with a single key or custom encryption for advanced use cases.
	Agent Server supports encryption at-rest for checkpoint data and metadata. You can choose between basic encryption with a single key or custom encryption for advanced use cases.

	\| Custom encryption \| Checkpoints + JSON fields \| Per-tenant keys, KMS integration, selective field encryption \|
	\| Custom encryption \| Checkpoints, threads, runs, assistants and crons \| Per-tenant keys, KMS integration, selective field encryption \|

	Encryption at-rest is available for LangGraph Platform deployments (Python graphs only).
	Encryption at-rest is available for Agent Server deployments (Python graphs only).

feat(langgraph+lsd): custom encryption at rest #1715

Are you sure you want to change the base?

feat(langgraph+lsd): custom encryption at rest #1715

Conversation

cwlbraa commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overview

Type of change

Related issues/PRs

Checklist

Additional notes

Uh oh!

github-actions bot commented Dec 2, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Dec 3, 2025

Uh oh!

github-actions bot commented Dec 3, 2025

Uh oh!

github-actions bot commented Dec 3, 2025

Uh oh!

github-actions bot commented Dec 3, 2025

Uh oh!

github-actions bot commented Dec 4, 2025

Uh oh!

jdrogers940 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Dec 4, 2025

Uh oh!

github-actions bot commented Dec 4, 2025

Uh oh!

jdrogers940 Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

jdrogers940 Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

jdrogers940 Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

cwlbraa Dec 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Dec 4, 2025

Uh oh!

katmayb left a comment

Choose a reason for hiding this comment

Uh oh!

katmayb Dec 8, 2025

Choose a reason for hiding this comment

Uh oh!

cwlbraa Dec 8, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

cwlbraa commented Dec 2, 2025 •

edited

Loading

cwlbraa Dec 8, 2025 •

edited

Loading