> ## Documentation Index
> Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Linear Integration

> Connect Strix to Linear to export vulnerabilities as issues and keep statuses in sync

export const ScarfPixel = () => <img referrerPolicy="no-referrer-when-downgrade" src="https://static.scarf.sh/a.png?x-pxid=831669b6-b4bd-42cb-8832-2122c03e1d5f" alt="" width="1" height="1" style={{
  position: "absolute",
  width: 0,
  height: 0,
  opacity: 0,
  pointerEvents: "none"
}} />;

<ScarfPixel />

Strix integrates natively with Linear so vulnerabilities found by scans and PR reviews can be exported as Linear issues and kept in sync in both directions. This page covers setup, the OAuth scopes requested, what data is exchanged, and how to disconnect.

## Overview

|                  |                                                                                          |
| ---------------- | ---------------------------------------------------------------------------------------- |
| Integration type | Native Linear OAuth 2.0 app — no third-party middleware in the data path                 |
| Direction        | Bidirectional: Strix creates/updates issues; Linear status changes sync back via webhook |
| Who can connect  | Strix organization **admins** only                                                       |
| Scope of access  | The Linear workspace the authorizing user approves                                       |

## Setup

1. In Strix, go to **Settings → Integrations** and click **Connect** on the Linear card. You must be an organization admin, and your plan must include ticketing integrations.
2. Approve the app on Linear's standard consent screen (`linear.app/oauth/authorize`). Linear redirects back to `https://app.strix.ai/api/integrations/linear/callback`, where Strix exchanges the authorization code for a token and records the workspace.
3. Back in Strix, pick a **default team or project** as the export destination, and optionally enable **auto-sync** with a minimum severity so new findings are exported automatically.

## OAuth scopes requested

| Scope   | Why Strix needs it                                          |
| ------- | ----------------------------------------------------------- |
| `read`  | List teams/projects and read issue status when syncing      |
| `write` | Create issues, post status comments, and update issue state |

Linear issues long-lived access tokens (no refresh token), so the connection persists until it is disconnected or revoked.

## What data flows where

**Strix → Linear** (when a vulnerability is exported, manually or via auto-sync):

* Issue title: the vulnerability title.
* Issue description: severity, CVSS/CVE (when present), target/endpoint or affected file, impact, technical analysis, evidence, suggested fix or remediation steps, proof of concept, and a link back to the issue in Strix.
* Priority mapped from severity, and a due date when an issue is snoozed.
* Status comments (e.g. "marked In Progress by …") when the Strix status changes.

**Linear → Strix** (via webhook on issue updates):

* The issue ID/identifier, its workflow state type (e.g. started / completed), and the display name of the actor who made the change. Strix maps the state back onto the linked vulnerability's status.

Strix does not read existing Linear issues, comments, or user directories; inbound processing is limited to status updates for issues Strix itself created.

## Security

* **Admin-gated**: both the connect and callback endpoints require an authenticated Strix org admin; the role is re-checked at the callback so a demoted user cannot complete a pending connection.
* **CSRF-protected OAuth**: the OAuth `state` is HMAC-signed, bound to the initiating organization and user, and expires after 10 minutes.
* **Signed webhooks**: Linear webhook deliveries are verified with HMAC-SHA256 signatures (timing-safe comparison) and a timestamp window to limit replay.
* **Token storage**: the access token is stored server-side in Strix's database, scoped to your organization, and never exposed to the browser or other tenants.
* **Revocation on disconnect**: disconnecting the integration revokes the token on Linear's side, so no live tokens remain.
* **Audit trail**: connecting the integration and settings changes are recorded in the Strix audit log.

## Disconnecting

An org admin can disconnect Linear at any time from **Settings → Integrations**, or via the API:

```bash theme={null}
curl -X DELETE "https://app.strix.ai/api/v1/integrations/linear" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"
```

**Required scope:** `integrations:write`

Disconnecting removes the stored token and revokes the OAuth grant. Issues already created in Linear are not deleted.