Linear
Create Linear issues from Safeguard. What the Linear API key needs, which keys work, and step-by-step setup.
Availability
This integration is switched on per workspace. If you do not see the card under Integrations, ask your Safeguard contact.
What it does
The Linear card connects Safeguard to one Linear team. Safeguard creates Linear issues for the findings and work you send to Linear and adds comments to them as they change. Find the card under Integrations on the Notification tab.
Public vs private
This does not apply to Linear: you always connect your own Linear workspace with an API key.
Supported auth methods
| Method | Use it when | Notes |
|---|---|---|
| Personal API key (dialog label API Key) | All connections | Created under Linear's Security & access settings. It acts as the person who created it |
| OAuth (sign in with Linear) | Not available yet |
Permissions required
Safeguard reads your identity, organization and teams, and creates issues and comments. It never edits or deletes existing issues, projects or teams.
Personal API key
| What the key must allow | Required? | What Safeguard uses it for |
|---|---|---|
| Read access (viewer, organization and teams) | Required | Checking the key and listing teams for Team (GraphQL viewer, organization, teams) |
| Create issues in the chosen team | Required | Creating issues (issueCreate) |
| Create comments | Required | Adding comments to the issues it created (commentCreate) |
The key works with the permissions of the person who created it, so that person must be a member of the team you pick. If Linear offers to limit the key's permissions or teams when you create it, keep read access, issue creation and comment creation, and include the team.
Least privilege: a key created by a dedicated Linear member of the one team, limited to that team where Linear allows it.
Token types
| Token type | Works? | Notes |
|---|---|---|
| Personal API key | Yes | Sent in the Authorization header without a Bearer prefix |
| OAuth access token | Not available yet | The dialog takes a personal API key |
| Webhook signing secret | No | It is not an API credential |
Expiry: keep track of when the key was created and replace it on a fixed schedule, such as every 90 days. When it is revoked, issue creation stops until you paste a new key.
What we never need: admin rights in Linear, or permission to delete or edit other issues.
Step-by-step setup
Create the credential in Linear
- In Linear, open Settings > Security & access.
- Under Personal API keys, create a new key and give it a name such as
Safeguard. - Copy the key. Linear shows it only once.
Or check it with curl
curl -s -X POST https://api.linear.app/graphql \
-H "Content-Type: application/json" -H "Authorization: $LINEAR_API_KEY" \
--data '{"query":"{ viewer { name } teams(first: 100) { nodes { key name } } }"}'Connect it in Safeguard
- Open Integrations and choose the Notification tab.
- Click Connect on the Linear card.
- On Credentials, enter an Integration Name, an optional Description, and paste the API Key.
- Click Next. Safeguard checks the key and lists your teams. On Destination, choose the Team.
- Click Connect.
Webhooks and triggers
The dialog does not set up Linear webhooks yet, so changes made in Linear are not sent back to Safeguard. Safeguard creates issues and adds comments when the events you route to Linear happen.
What we read and store
- Read: the key's user, your organization name and your teams.
- Stored: the connection's name, team, links between Safeguard items and Linear issues, and the API key. Safeguard never shows the key again in the dialog.
- Sent to Linear: issue titles, descriptions and comments about your Safeguard findings.
- No customer data from this integration is sent to third-party LLMs.
Troubleshooting
| Message you see | Cause | Fix |
|---|---|---|
Linear validation failed: ... | Linear refused the key (revoked or mistyped) | Create a new key and paste it |
No teams found for these credentials | The key's user is not in any team, or the key is limited to no team | Add the user to the team, or create a key with access to it |
Failed to save configuration | The connection could not be saved | Check the fields and try again |
Rotation and disconnect
- Rotate: create a new API key, open the Linear connection on the Notification tab, choose Update, paste the new key and choose Save Changes. Then revoke the old key under Security & access.
- Disconnect: choose Delete on the connection, then revoke the key in Linear. Issues already created stay in Linear.
Vendor references
- Linear GraphQL API: authentication and personal API keys, checked 2026-10-16.