**JavaScript SDK:** [`swarmhit.accounts.hostedLinks.create(params)`](/smart-api/sdk/methods#accounts.hostedLinks) Mint a one-time URL where a person connects their own LinkedIn account on a page Swarmhit serves, so your product never handles their LinkedIn password. Send them to `url`; they sign in, clear any verification step LinkedIn raises, and are redirected back to your `redirectUrl`. The sender lands in the effective workspace (the one named by the X-Swarmhit-Workspace header, if set) and consumes a seat from its allocation. The seat is checked when the link is created, so a full workspace fails here (400 `seat-limit-reached`, or `no-plan` without an active plan) rather than at the end of the person's sign-in. It is checked, not reserved; a workspace whose seats are added on demand is not refused. The page carries your organization's name and picture by default; both can be overridden, and a default return URL set, in your organization settings — so `redirectUrl` only has to be sent when a particular link should land somewhere else. With `accountId` the link REPAIRS that sender instead of adding one: it keeps its id, its campaigns and its seat, and no seat is consumed. The exception is a change of sign-in method (a browser-session sender signing back in with a password, or the reverse): the sender then comes back under a new id, its campaign pools move to it and the old one is removed, so read the id from `account_id` on the redirect. An `accountId` that is not a sender in the workspace is a 400 with `code: account-not-found`. A failed sign-in attempt does not end the link: the person can try again until it expires or they cancel, and each attempt LinkedIn refuses fires account.connection_failed. You learn the outcome three ways, and can use any of them: the redirect back carries `?hosted_link_id=&status=connected|failed|expired|cancelled &account_id=&external_id=`; the account.connected / account.connection_failed webhooks carry `hostedLinkId` and `externalId`; and GET /accounts/hosted-link/{id} returns the current state. `url` is returned once, here — the token inside it is stored only as a hash and cannot be read back.