Late Accounts

Late.dev Account Management

OAuth Connect Flow (PKCE)

1. CLI generates PKCE code verifier + challenge
2. Opens browser to Late.dev OAuth URL with state + challenge
3. Late.dev handles the full OAuth exchange
4. CLI receives confirmation via headless mode callback
5. Account appears in accounts list

node ../../../../.founderOS/scripts/late-tool.mjs accounts connect \
  --platform=linkedin --profile=default

Security requirements:

• PKCE: Required for CLI/public clients per OAuth 2.1
• State parameter: Cryptographic random, validated on callback (CSRF prevention)
• Redirect URI: localhost callback with random port or Late.dev headless mode
• Audit logging: Log connect/disconnect events to .late/audit.log (no credentials)