Connect a LinkedIn sender with its email/username and password; optionally a proxy and country. The sender lands in the effective workspace (the one named by the X-Swarmhit-Workspace header, if set), consuming a seat from its allocation. Credentials are stored encrypted and never returned. The outcome and later changes arrive via the account.* webhooks.
To connect a sender without ever handling their password, create a hosted connect link instead (POST /accounts/hosted-link) and send the person to it.
A sender can also be connected from an existing browser session: send `liAt` (the LinkedIn session cookie value) and the `userAgent` of the browser it came from, instead of `username` / `password`. The session is stored encrypted and `connectionMethod` is `cookie`; checkpoints and webhooks behave the same. A browser session cannot re-establish itself, so these senders never reconnect on their own: repair one by POSTing a fresh `liAt` to POST /accounts/{id}/reconnect. Password sign-in with a `totpSecret` is the lower-maintenance path. `proxy` and `country` may accompany `liAt` exactly as they do a password sign-in, and a reconnect keeps the sender's stored proxy unless it sends a new one.
Add a 2FA setup key (`totpSecret`) for automatic (infinite) login: the sign-in then completes hands-free, solving a 2FA challenge from the secret. Anything else fails with 400 and an account.connection_failed webhook rather than leaving a half-connected sender holding a seat.
Without a `totpSecret` the connect is interactive. If LinkedIn asks for a verification step the response is 200 with `status` `checkpoint_required` and a `checkpoint` object describing it; answer it on POST /accounts/{id}/checkpoint within five minutes. An account.checkpoint_required webhook fires at the same time.
On failure the error body carries a stable `error.code` to branch on and a plain-language `error.message` describing what went wrong. Codes for this endpoint: `invalid-credentials` (wrong email/password), `invalid-session` (the `liAt` browser session was rejected; copy a fresh one), `rate-limited` (LinkedIn is throttling sign-in; retry later), `proxy-failed` (the proxy sent with the request did not respond, so the sign-in never reached LinkedIn), `provider-timeout` / `provider-unreachable` (LinkedIn answered too slowly, or could not be reached at all; safe to retry), `checkpoint-code-rejected` (the account's 2FA setup key is wrong, so the authenticator code is rejected), `checkpoint-restricted` (LinkedIn has restricted the account; clear it on linkedin.com and connect again), `unsupported-verification` (automatic login was requested but the account signs in with a method other than authenticator 2FA — connect it without a `totpSecret` and answer the challenge instead), `verification-required` / `verification-failed` (a verification step that can't be completed automatically), `invalid-totp-secret` (the 2FA key isn't a valid authenticator key), `already-connected`, `no-plan`, and `seat-limit-reached` (409), and `connection-failed` for anything else, where `error.message` carries the specific reason. The same `code` is included on the account.connection_failed webhook.