---
title: "Start a credential/cookie authentication"
method: POST
path: "/v1/auth/intent"
tags: ["Auth"]
---

# Start a credential/cookie authentication

`POST /v1/auth/intent`

## Request

- Base URL: `https://api.curviate.com`
- URL: `https://api.curviate.com/v1/auth/intent`
- Auth: HTTP bearer

Authenticates a LinkedIn account with credentials or a cookie, nested: auth_method credentials reads credentials: { email, password }; auth_method cookie reads cookie: { li_at }. Omit account_id for a new account; include it to reconnect. Returns the account or a 202 checkpoint.

## Request body

- object
  - `seat_id` string: The empty seat this NEW account will occupy. Required on a new connect; omit it and the call returns 400 INVALID_REQUEST with 'seat_id is required'. Seat ids look like seat_01H..., and every seat you own is listed by GET /v1/accounts/seats (any item with occupied false is free to use) and with click-to-copy in the seat table on your dashboard. Ignored when account_id is present, because a reconnect keeps the account on its current seat.
  - `auth_method` 'credentials' | 'cookie', required: How to authenticate. 'credentials' reads the nested `credentials` object (email + password). 'cookie' reads the nested `cookie` object (li_at) and also requires a top-level `user_agent`. Neither set of fields is accepted at the top level.
  - `credentials` object: Email + password authentication, supplied as a NESTED object (email and password do not go at the top level). Required when auth_method=credentials.
    - `email` string, required: LinkedIn account email.
    - `password` string, required: LinkedIn account password. Encrypted at rest, never logged.
  - `cookie` object: Session-cookie authentication, supplied as a NESTED object (li_at does not go at the top level). Required when auth_method=cookie, which also requires a top-level user_agent.
    - `li_at` string, required: LinkedIn session cookie (li_at). Encrypted at rest, never logged.
    - `li_a` string: Optional premium-session cookie for Sales Navigator / Recruiter sessions. Encrypted at rest, never logged.
  - `account_id` string: Present = re-authenticate this existing account in place (reconnect); omit = connect a new account.
  - `linkedin_premium` 'sales_navigator' | 'recruiter': Optional. Which LinkedIn premium surface this connection should ask for: 'sales_navigator' or 'recruiter'. Omit it and the connection asks for every product, and LinkedIn activates whichever ones the account actually has. One LinkedIn account can hold only one of the two premium surfaces, and when both are asked for Sales Navigator takes precedence, so set this to 'recruiter' if the account holds both and you want the Recruiter surface. This applies per connection and is not remembered: state it on every connect and reconnect where Recruiter must win.
  - `timezone` string: Optional IANA zone name for this account's LinkedIn session, e.g. Europe/Berlin. Sent in canonical form; a UTC offset such as +02:00 is a 400.
  - `external_id` string: Your own id for the end user who owns this account, 1-255 chars, not unique. Treat it as opaque; avoid emails.
  - `products` string[]: Optional allow-list of premium products to ask for: sales_navigator, recruiter. Omit to ask for both; [] asks for none. Classic LinkedIn and company pages are always included.
  - `country` 'AE' | 'AO' | 'AR' | 'AT' | 'AU' | 'BD' | 'BE' | 'BG' | 'BR' | 'CA' | 'CH' | 'CL' | 'CN' | 'CO' | 'CY' | 'CZ' | 'DE' | 'DK' | 'EE' | 'EG' | 'ES' | 'FI' | 'FR' | 'GB' | 'GT' | 'HK' | 'ID' | 'IE' | 'IL' | 'IN' | 'IT' | 'JP' | 'KR' | 'KZ' | 'MA' | 'MX' | 'MY' | 'NL' | 'NO' | 'PA' | 'PH' | 'PK' | 'PL' | 'PR' | 'PT' | 'RO' | 'SA' | 'SE' | 'SG' | 'TH' | 'TN' | 'TR' | 'UA' | 'US' | 'VN' | 'ZA': Where LinkedIn sees this account connecting from: a supported ISO 3166-1 alpha-2 country code (e.g. US, DE; case-insensitive). Pick the country the account owner normally signs in from. A new connect needs exactly one of country, ip or proxy. Strict by default: the connect fails rather than use another country, unless allow_country_fallback is true.
  - `ip` string: A public IPv4 address; its country becomes the connection location (strict by default). An alternative to country: send exactly one of country, ip or proxy on a new connect.
  - `allow_country_fallback` boolean: Optional. false (the default with country or ip): only ever connect from that country; a connect fails when no connection is free there. true: a connection from another country may be used when none is free in the chosen one. Not accepted with proxy.
  - `proxy` object: Your own proxy for this account's traffic. The proxy decides where LinkedIn sees the account connecting from, so country, ip and allow_country_fallback are not accepted with it.
    - `protocol` 'http' | 'https' | 'socks5' | 'socks4', required: Proxy protocol. One of http, https, socks5, socks4.
    - `host` string, required: Proxy host or IP.
    - `port` integer, required: Proxy port (1-65535).
    - `username` string: Proxy auth username (optional).
    - `password` string: Proxy auth password (optional). Passed to the connection only: never stored, logged or returned.
  - `user_agent` string: Exact browser User-Agent to pin for this account. REQUIRED for a cookie connect: send the User-Agent of the browser the li_at cookie was copied from. Optional for a credentials connect, where it helps an account that hits disconnection issues.
  - `sync_limit` object: Optional caps on how much history is synced for this account.
    - `chats` integer: Maximum number of chats to sync.
    - `messages` integer: Maximum number of messages to sync per chat.
  - `recruiter_contract_id` string: Which Recruiter contract to bind this account to. Only meaningful when the LinkedIn account holds a Recruiter subscription.

## Response `200`

The account was re-authorized in place (same account_id, same seat).

- object
  - `object` 'account': Response type discriminator.
  - `account_id` string
  - `status` 'active'
  - `external_id` string, nullable: Your own id for this account's end user, as set on connect or PATCH. Null when none. Not unique.
  - `connection_location` object: Where LinkedIn sees this account connecting from. country: the configured country (ISO 3166-1 alpha-2), the one the account is set to use. current_country: the country of the connection in use right now; it differs from country only after a fallback, which can happen only when strict is false. mode: auto (a managed connection in country) or custom (your own proxy). strict: true when the account never connects from another country, null when unknown. Each field is null until known; an account connected through ip or your own proxy may show null until the next background refresh. Change it with PATCH /v1/accounts/{account_id} (country), or by reconnecting with country.
    - `country` string, nullable: Configured country (ISO 3166-1 alpha-2).
    - `current_country` string, nullable: Country of the connection in use right now.
    - `mode` 'auto' | 'custom' | 'null', nullable: auto: managed connection. custom: your own proxy.
    - `strict` boolean, nullable: true: never connects from another country.
    - `previous_country` string: Present only when this connect landed on an account you already had and changed its configured country (to another one, to unknown with ip, or to your own proxy). It names the country before.
  - `safety_warning` SafetyWarning: Present on a successful response when this account crossed an account-safety ceiling while the affected budget row is on the default warn posture. The action still happened. Field-identical to the BUDGET_EXHAUSTED error body except that blocked is false and hint.message describes the outcome, so one branch handles both postures and switching the account to enforce is a configuration change rather than a client rewrite.
    - `row` string, nullable, required: The budget row that breached, for example profile_views or pending_invites. Null when the breach is not about a row: an activity_window warning on an action that spends no budget of its own (editing a message, dismissing a notification, a Recruiter or Sales Navigator admin action) is still governed by the hours the account works in. Read hint.parameter for what to change; whenever this is null it names posture, because the activity window edges are set per action type and this action has none, so the levers that reach it are the account timezone and posture.
    - `reset_at` string, nullable, required: The instant the refusal lifts: the window roll on a ceiling refusal, the next window open on an activity-window one. Null in the two cases no clock frees, the pending_invites gauge and InMail credits (row inmail).
    - `hint` object, required
      - `parameter` string, required: The settable parameter on PATCH /v1/{account_id}/safety-policy.
      - `message` string, required: What the condition is and what changing that parameter would do. This is the one field whose text differs from the BUDGET_EXHAUSTED refusal: here it says the action went through, and on a ceiling breach how far past the ceiling this row now stands, rather than telling you to set posture to warn when it already is. Branch on parameter, reason and blocked, never on this text.
    - `reason` 'ceiling' | 'activity_window', required: Which rule was crossed. ceiling means the row's configured limit is spent; activity_window means the account is outside the hours it works in, which is a different fact with a different remedy. hint.parameter names the right setting for each.
    - `blocked` boolean, required: Always false here. True on the BUDGET_EXHAUSTED refusal carrying the same payload.

## Other responses

- `201`: Account connected and bound to the seat.
- `202`: A verification challenge is required. Resolve it via the checkpoint sub-resource (POST /v1/auth/checkpoint/solve) using the returned account_id.
- `400`: CONNECTION_LOCATION_REQUIRED: a new connect names no location; send exactly one of `country` (a supported ISO code, e.g. `US`), `ip` (a public IPv4) or your own `proxy`. INVALID_REQUEST. The most common causes: two location sources at once (`ip` overrides `country`, `proxy` overrides both, so send one); an unsupported `country` (use `proxy` for a location we don't serve); a private or reserved `ip`; `allow_country_fallback` together with `proxy`; your own proxy rejected its credentials, could not be reached or timed out (the message names which); the auth block is at the top level instead of nested (send `credentials: { email, password }` or `cookie: { li_at }`, not bare `email`/`password`/`li_at`); `seat_id` is missing on a new connect; or a cookie connect has no top-level `user_agent`. SEAT_NOT_FOUND if the seat id is unknown or is not yours.
- `401`: LinkedIn rejected the supplied credentials or cookie.
- `402`: Either PAYMENT_REQUIRED (an active subscription / seat is needed; update your payment method or purchase a seat) or ACCOUNT_DISPUTED (the tenant's account is under dispute review; contact support). The code field distinguishes the two.
- `403`: Either LINKEDIN_FEATURE_NOT_SUBSCRIBED (this LinkedIn account is not subscribed to a premium product the connection asked for, Sales Navigator or Recruiter; activate that subscription on LinkedIn and connect again, or set linkedin_premium to the premium the account actually holds), or ACCOUNT_RESTRICTED (LinkedIn has restricted this account; sign in to LinkedIn to see what it needs, resolve it there, then connect again). The code field distinguishes the two.
- `409`: ACCOUNT_ALREADY_LINKED: this LinkedIn account is already linked. It names your own account_id when your tenant owns it; otherwise no id is named, it is not one you can manage here, and retrying will not help. CONNECTION_IN_PROGRESS: another connection attempt for this identity is open; wait for it to finish or expire.
- `413`: Payload too large, the request body exceeds the size limit.
- `422`: CONNECTION_LOCATION_UNAVAILABLE: no connection is free in the country you chose right now (it is strict); try a nearby country, or send allow_country_fallback: true. Also returned when the connect re-attached an account you already had and its location could not be changed here (sent as ip): the body carries connection_location, and PATCH /v1/accounts/{account_id} with country moves it. CHECKPOINT_UNSUPPORTED: the verification challenge cannot be resolved automatically (a dead-end challenge such as a CAPTCHA or a phone-number registration). For those two dead-ends the error body carries a machine-readable challenge_type (captcha | phone_register) so a client can render the right guidance; other unsupported challenges carry no challenge_type.
- `429`: Rate limited. LinkedIn or the per-account ceiling is throttling connection attempts.
- `500`: Internal error.
- `502`: A temporary error occurred. Please try again.
- `503`: Service unavailable.
- `504`: Gateway timeout.

---

[API](https://skmtc.dev/curviate/apis/curviate-api.md) · [All operations](https://skmtc.dev/curviate/apis/curviate-api/llms.txt) · [OpenAPI document](https://skmtc.dev/curviate/apis/curviate-api/revisions/eab848801d95?raw)