lindy-security-basics

# Lindy Security Basics ## Overview Security practices for Lindy AI agents. Agents are autonomous — they connect to external services, execute actions, and handle data. Security focuses on: API key management, webhook authentication, agent permission scoping, integration account isolation, and connection sharing controls. ## Prerequisites - Lindy account with API access - Understanding of which integrations your agents use - For Enterprise: SSO/SCIM configuration access ## Instructions ### Step 1: API Key Management ```bash # Store API key in environment variable — never in source code export LINDY_API_KEY="lnd_live_xxxxxxxxxxxxxxxxxxxx" # Or use a secret manager # AWS Secrets Manager aws secretsmanager create-secret \ --name lindy/api-key \ --secret-string "$LINDY_API_KEY" # Google Secret Manager echo -n "$LINDY_API_KEY" | gcloud secrets create lindy-api-key \ --data-file=- ``` **Key rotation schedule**: | Environment | Rotation Period | Method | |-------------|----------------|--------| | Development | 30 days | Manual regeneration | | Staging | 90 days | Automated via CI | | Production | 90 days | Secret manager + automated rotation | | Post-incident | Immediately | Manual regeneration + revoke old key | ### Step 2: Webhook Authentication Every webhook trigger generates a unique secret key. Verify it on every inbound request: ```typescript // Webhook signature verification middleware function verifyLindyWebhook( req: express.Request, res: express.Respons...