Security

Two-factor authentication

Two-factor authentication (2FA) adds a code from an authenticator app (1Password, Google Authenticator, Authy…) to every new sign-in. It’s available to everyone and recommended, especially for owners and admins.

1. In the dashboard, open Settings → Security and click Set up authenticator.
2. Add the secret to your authenticator app, then enter the 6-digit code it shows and click Confirm and turn on.
3. Save your recovery codes. Linnia shows 8 one-time recovery codes once. Store them in your password manager; each works once if you lose your phone.

From then on, every new sign-in (dashboard and assistant connections) asks for a code. Until it’s entered, the session can’t do anything else; API calls with it answer 401 totpRequired.

Lost your phone?

Sign in with your password and enter one of your recovery codes instead of the app code. Then set up 2FA again on your new device. If you’ve lost the recovery codes too, ask your workspace owner or hello@linnia.ai.

To turn 2FA off, go to Settings → Security and confirm with your password.

Passwords and sign-in

• At least 12 characters. In production, passwords are checked against known breached passwords.
• Five wrong attempts lock the account for 15 minutes.
• Passwords are stored as scrypt hashes.
• Password reset links last one hour; email verification links 48 hours; invitations 7 days. Each works once.
• Sessions last 30 days and extend while you use them. Changing your password signs out your other sessions; being disabled signs you out everywhere.

LinkedIn credentials

The rep types their LinkedIn password into Linnia’s own connect page. Linnia doesn’t store it; the LinkedIn session is held by Linnia’s LinkedIn provider. Assistants and API integrations never see LinkedIn credentials: they get a link to that page instead.

API keys

• Keys start with lin_, are shown once when created, and are stored only as a hash.
• Only owners and admins can create and revoke them, under Integrations → API keys.
• Revoking a key works immediately and also ends any assistant connection that was authorised with it.

Webhooks

Every delivery is signed with a per-endpoint secret (HMAC-SHA256), shown once when you add the endpoint. Endpoints must use https and may not point at private or local addresses. See Webhooks.

Assistant connections

Assistants connect with OAuth: they never get your password or an API key. Each connection is limited to the LinkedIn accounts and permissions you approved at sign-in, and approvals can only be given by a person.