Authentication

lin authenticates with a Linear personal API key (lin_api_...), never passed as a flag. Create one in Linear under Settings, then Security and access, then API. The key is masked (first four and last four characters) anywhere lin prints it.

Recommended: lin auth login

The easiest way is to log in once. lin auth login reads the key (piped stdin or a hidden prompt), validates it against Linear, and stores it in ~/.config/lin/config.json (mode 0600) so you never re-export it:

lin auth login                 # prompts for the key (hidden), or:
echo "$LINEAR_API_KEY" | lin auth login
lin whoami                     # confirm it worked

Multiple workspaces (profiles)

Keys are stored as named profiles. Log in to as many as you like and switch between them:

lin auth login --profile work    # store a second workspace
lin auth login --profile perso
lin auth status                  # list profiles, see which is active
lin auth switch work             # make "work" the default
lin issue list --profile perso   # or select per-command
lin auth logout --profile perso  # remove one

The active profile is picked, in order: the --profile flag, the LIN_PROFILE environment variable, the default profile, else default.

Environment variables (CI, agents, one-off)

Environment variables always take priority over stored profiles, so scripts and headless runs stay explicit and stateless:

export LINEAR_API_KEY=lin_api_...          # 1. the key directly, or
export LINEAR_API_KEY_FILE=~/.secrets/lin  # 2. a file containing the key

The full precedence is: LINEAR_API_KEY > LINEAR_API_KEY_FILE > the selected stored profile.