linear-security-basics

# Linear Security Basics ## Overview Secure authentication patterns for Linear integrations: API key management, OAuth 2.0 with PKCE, token refresh (mandatory for new apps after Oct 2025), webhook HMAC-SHA256 signature verification, and secret rotation. ## Prerequisites - Linear account with API access - Understanding of environment variables and secret management - Familiarity with OAuth 2.0 and HMAC concepts ## Instructions ### Step 1: Secure API Key Storage ```typescript // NEVER hardcode keys // BAD: // const client = new LinearClient({ apiKey: "lin_api_xxxx" }); // GOOD: environment variable import { LinearClient } from "@linear/sdk"; const client = new LinearClient({ apiKey: process.env.LINEAR_API_KEY!, }); ``` **Environment setup:** ```bash # .env (never commit) LINEAR_API_KEY=lin_api_xxxxxxxxxxxxxxxxxxxxxxxxxxxx LINEAR_WEBHOOK_SECRET=whsec_xxxxxxxxxxxx # .gitignore .env .env.* !.env.example # .env.example (commit for documentation) LINEAR_API_KEY=lin_api_your_key_here LINEAR_WEBHOOK_SECRET=your_webhook_secret_here ``` **Startup validation:** ```typescript function validateConfig(): void { const key = process.env.LINEAR_API_KEY; if (!key) throw new Error("LINEAR_API_KEY is required"); if (!key.startsWith("lin_api_")) throw new Error("LINEAR_API_KEY has invalid format"); if (key.length < 30) throw new Error("LINEAR_API_KEY appears truncated"); } validateConfig(); ``` ### Step 2: OAuth 2.0 with PKCE ```typescript import express from "express"; import...