lenshq/linear
Work with issues, projects, and cycles in a Linear workspace.
Linear connector
Lets a workload reach the Linear API without the credential ever entering the sandbox.
lns connector install lenshq/linear
What it serves
api.linear.app — Linear's GraphQL API at https://api.linear.app/graphql.
linear.app is not served. The browser sign-in sends you there, but the
workload never talks to it.
How you sign in
Two methods. Pick either when lns asks.
Linear account — browser sign-in. lns opens Linear, you approve, and the
token comes back to a loopback listener on 127.0.0.1. Choose read-only, or
read and write.
Personal API key — create one in Linear under Settings, Account, Security and access, then paste it.
What the workload sees
| Variable | Value |
|---|---|
LINEAR_TOKEN | A placeholder, never the credential. |
Both methods fill the same variable, so a workload does not care which one you used.
What differs is the wire format, and it is the reason this connector has two
methods rather than one. A Linear OAuth token is sent as
Authorization: Bearer <token>, but a personal API key is sent as
Authorization: <key> with no scheme word at all. lns applies the right form
for the method you connected with.
The value is a marker, not a credential: lns substitutes the real one into
requests to api.linear.app and nowhere else. A request the workload sends to
any other host carries no Linear credential, even if the workload copies the
variable there itself.
The variable is lent to a sandbox that declares it, so a sandbox asking for nothing receives nothing.
What it grants
Requests to api.linear.app only. Installing the connector grants nothing on
its own — the destination still has to be allowed, and connecting the account is
what allows it.
A personal API key carries your own permissions and cannot be narrowed by lns. Browser sign-in can: pick read-only and the token Linear issues cannot write.
Specification
Serves
api.linear.appReaching one of these makes a run ask about this connector. Installing it opens nothing on its own.
2 methods
Alternatives, in the author's order of preference. A run grants one, and only that method's payload applies.
browserSign in through your browser. lns listens on 127.0.0.1 for the callback.Opens on a grant
| Protocol | Destination | Verdict |
|---|---|---|
http | api.linear.app | allow |
Credentials
| Variable | Placeholder | Injected into |
|---|---|---|
LINEAR_TOKEN | lin_LNSPLACEHOLDER0000000000 | bearer header → api.linear.app |
tokenCreate a key in Linear under Settings, Account, Security and access.Opens on a grant
| Protocol | Destination | Verdict |
|---|---|---|
http | api.linear.app | allow |
Credentials
| Variable | Placeholder | Injected into |
|---|---|---|
LINEAR_TOKEN | lin_LNSPLACEHOLDER0000000000 | API key header → api.linear.app |