generated: '2026-08-29'
method: searched
source: >-
  https://docs.lindy.ai/skills/by-lindy/webhooks ,
  https://docs.lindy.ai/integrations/credentials ,
  https://docs.lindy.ai/integrations/mcp , live probes
provider: Lindy
providerId: lindy
description: >-
  Authentication profile for Lindy. Derived from documentation rather than a
  spec, because Lindy publishes no OpenAPI securitySchemes. Two distinct
  directions must not be confused: how a caller authenticates TO Lindy (one
  scheme, on one endpoint), and how Lindy authenticates OUT to the tools it
  integrates with (OAuth and API keys, the much larger surface).
derived_from_spec: false
spec_reason: No OpenAPI is published. See conformance/lindy-conformance.yml.
inbound:
  description: How an external caller authenticates to a Lindy-hosted endpoint.
  schemes:
    - id: webhook-bearer
      type: http
      scheme: bearer
      applies_to: https://public.lindy.ai/api/v1/webhooks/[unique-id]
      header: 'Authorization: Bearer [your-secret-key]'
      credential: >-
        A per-webhook secret generated in the Lindy UI and displayed exactly
        once. No prefix convention, expiry, rotation procedure or revocation
        endpoint is documented.
      scoped: per webhook
      source: https://docs.lindy.ai/skills/by-lindy/webhooks
    - id: mcp-anonymous
      type: none
      applies_to: https://docs.lindy.ai/mcp
      detail: >-
        The documentation MCP server accepts anonymous calls;
        /.well-known/mcp.json declares "authentication": "none". Verified by an
        unauthenticated tools/list returning 200 on 2026-08-29.
      source: https://docs.lindy.ai/.well-known/mcp.json
outbound:
  description: >-
    How Lindy authenticates to third-party tools on the user's behalf. This is
    the dominant auth surface in Lindy's docs, and it is Lindy acting as client.
  models:
    - id: oauth-connect
      type: oauth2
      detail: >-
        Most integrations connect with an OAuth button; every action for that
        tool is enabled at once. Multiple accounts can be attached to one
        integration.
      source: https://docs.lindy.ai/integrations/overview
    - id: stored-credential
      type: apiKey
      detail: >-
        Tools without an OAuth flow use a saved credential — an API key stored
        once in the workspace, named for the tool (e.g. NOTION_API_KEY), kept
        private or shared with the workspace, and used by Lindy without being
        pasted into a chat.
      source: https://docs.lindy.ai/integrations/credentials
    - id: mcp-server-auth
      type: mixed
      detail: >-
        For third-party MCP servers Lindy connects to: anonymous and
        OAuth-flow servers need nothing configured; a static credential can be
        sent as an Authorization bearer token, a custom header, or a query
        parameter.
      source: https://docs.lindy.ai/integrations/mcp
enterprise_identity:
  sso: 'Listed as an Enterprise-tier feature on https://docs.lindy.ai/pricing'
  scim: 'Listed as an Enterprise-tier feature on https://docs.lindy.ai/pricing'
  documented_configuration: false
oauth_server:
  published: false
  probes:
    - url: https://www.lindy.ai/.well-known/oauth-authorization-server
      status: 404
    - url: https://docs.lindy.ai/.well-known/oauth-authorization-server
      status: 404
    - url: https://docs.lindy.ai/.well-known/oauth-protected-resource
      status: 404
    - url: https://www.lindy.ai/.well-known/openid-configuration
      status: 404
scopes:
  published: false
  note: >-
    No OAuth scope reference exists for Lindy as a provider — Lindy issues no
    OAuth tokens. scopes/ is therefore deliberately not written; see the
    OAuth-only applicability rule in pipeline-enrich.md.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com