lindy-security-basics

name	lindy-security-basics
description	Implement security best practices for Lindy AI agents and integrations. Use when securing API keys, configuring agent permissions, verifying webhooks, or auditing agent access. Trigger with phrases like "lindy security", "secure lindy", "lindy API key security", "lindy permissions", "lindy audit".
allowed-tools	Read, Write, Edit, Bash(curl:*)
version	1.15.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","lindy","api","security"]
compatibility	Designed for Claude Code, also compatible with Codex and OpenClaw

Lindy Security Basics

Overview

Security practices for Lindy AI agents. Agents are autonomous — they connect to external services, execute actions, and handle data. Security focuses on: API key management, webhook authentication, agent permission scoping, integration account isolation, and connection sharing controls.

Prerequisites

• Lindy account with API access
• Understanding of which integrations your agents use
• For Enterprise: SSO/SCIM configuration access

Instructions

Step 1: API Key Management

# Store API key in environment variable — never in source code
export LINDY_API_KEY="lnd_live_xxxxxxxxxxxxxxxxxxxx"

# Or use a secret manager
# AWS Secrets Manager
aws secretsmanager create-secret \
  --name lindy/api-key \
  --secret-string "$LINDY_API_KEY"

# Google Secret Manager
echo -n "$LINDY_API_KEY" | gcloud secrets create lindy-api-key \
  --data-file=-

Key rotation schedule:

Environment	Rotation Period	Method
Development	30 days	Manual regeneration
Staging	90 days	Automated via CI
Production	90 days	Secret manager + automated rotation
Post-incident	Immediately	Manual regeneration + revoke old key

Step 2: Webhook Authentication

Every webhook trigger generates a unique secret key. Verify it on every inbound request:

// Webhook signature verification middleware
function verifyLindyWebhook(
  req: express.Request,
  res: express.Response,
  next: express.
) {
   authHeader = req..;
   expectedToken = process..;

   (!authHeader || authHeader !== ) {
    .(, {
      : req.,
      : req.,
      :  ().(),
    });
     res.().({ :  });
  }

  ();
}

app.(, verifyLindyWebhook,  {
  
  (req.);
  res.({ :  });
});