Developer guide · LinkedIn preview

Your first agent handoff.

Connect LinkedIn, issue a limited grant, and start with a read. Every outbound message waits for the owner to approve its recipient and text.

Open agent setup →

Transport

Remote MCP · Streamable HTTP

Authentication

Owner-issued Bearer grant

Current destination

LinkedIn

  1. 1. Connect and authorize

    Create an account and sign in to LinkedIn through hosted Anchor OmniConnect. Return to Agent setup and create a one-hour, read-only grant. The token is shown once: keep it private.

    The grant token is separate from your Behalf password and LinkedIn sign-in. To test a reply, choose “Reply with approval.”

  2. 2. Configure your MCP client

    Agent setup generates a configuration for Claude Code or Cursor using the same Behalf host. Select your client, copy its config, and merge the entry into your existing configuration.

    Endpoint: https://YOUR_BEHALF_HOST/api/mcp

    Authorization: Bearer YOUR_GRANT_TOKEN

    Set BEHALF_GRANT_TOKEN in the environment that launches your client. The generated config references this variable so you do not paste the token into a shared project file.

    This preview uses a Bearer grant. There is no Behalf npm installation or OAuth connector. A successful Behalf connectivity check does not prove the client is configured.

  3. 3. Make the first read

    Use “Try the handoff here” in Agent setup, or ask your agent to list Behalf's tools and call list_threads. Use identifiers returned by the application. Empty results can be legitimate; they do not prove that every conversation was inspected.

    Grant-scoped resources: behalf://audit/grant/current and behalf://pending.

  4. 4. Approve a specific write

    With a “Reply with approval” grant, give the agent the recipient and exact message. Review the saved request in Approvals. A held action waits for its result; submitting another request does not bypass approval.

    For REST writes, send a unique Idempotency-Key and keep it for that action. Never retry an uncertain write with a new key.

  5. 5. Inspect the receipt and revoke

    Refresh results in Agent setup. Check the permission decision, execution outcome, and destination evidence. Confirm the message in LinkedIn. Revoke the grant when finished; future requests should be refused.

Custom agent: REST read and receipt lookup

Set BEHALF_BASE_URL to your Behalf host and BEHALF_GRANT_TOKEN in your shell. This makes a real read and may consume an action from the grant's limit.

curl --fail-with-body "$BEHALF_BASE_URL/api/agent/actions" \
  -H "Authorization: Bearer $BEHALF_GRANT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"type":"list_threads"}'

Inspect outcome, receiptId, data, and evidence. Poll the receipt with the same Bearer header; this does not repeat the action:

GET /api/agent/actions?receiptId=YOUR_RECEIPT_ID

202 means held or processing. 409 can mean an unknown outcome. Inspect the receipt and destination before repeating a write.

If the handoff stops

401 · token rejected
Check the Bearer header and expiry. Create a new grant if the token was lost.
403 · outside the grant
Check grant status and policy. Update permissions in the owner UI; a prompt cannot expand authority.
No receipt or an unknown result
Confirm the client invoked Behalf. Keep the receipt or error, inspect LinkedIn, and resolve the outcome before repeating a write.

Behalf governs requests made through Behalf. Independent tools, credentials, and browser sessions remain outside this boundary. Read the security model.