Team & Settings
Administer your Lynkist workspace — profile and organization settings, timezone, inviting teammates with roles, and configuring outbound webhooks.
This guide covers the administrative side of Lynkist: your Settings area. It's where you manage who you are, who's on your team, and how the workspace connects to the outside world. (The WhatsApp connection itself has its own guide — see WhatsApp Setup.)
Where everything lives
Settings has ten tabs. What you can see depends on your role — billing, the WhatsApp connection and the audit log are all permission-gated.
| Tab | What's in it |
|---|---|
| Account | Your personal profile, the organization, data export, and account deletion |
| Team | Members, pending invites, and roles |
| Your connected numbers, the business profile, and the connection test | |
| Billing | Your plan, invoices, and add-ons |
| Wallet | Prepaid balance, top-ups, and per-conversation spend |
| Contacts | Groups, sources, and custom fields |
| Import / Export | Bulk contact import and export |
| Notifications | Which alerts you receive, and how |
| Security | Password, two-factor, and API keys |
| Activity | The audit log — who did what, and when |
Account — you, and the workspace
Settings → Account holds two sections.
Your profile is personal, and each teammate manages their own: first name, last name, email, your role (read-only — an admin changes it from the Team tab), and your personal timezone.
Organization is the workspace, shared by everyone:
- Company name and workspace URL — both set during onboarding and shown read-only. Contact support if you need either changed.
- Timezone — the workspace default, editable by an admin.
Why timezone matters
Lynkist stores all timestamps in UTC internally, but displays and schedules them in the effective timezone. Your personal setting takes priority where available, falling back to the workspace timezone. Get this right before scheduling campaigns — a wrong timezone is the usual reason a "9am" send goes out at the wrong hour.
Set the workspace timezone correctly before your first scheduled campaign. Scheduling is interpreted in the effective timezone, so a mismatch sends at the wrong local time for your audience.
Team — invite and manage people
Settings → Team is where you build your team:
- Team Members — everyone with access, and their role.
- Pending Invites — people invited who haven't accepted yet.
- Roles & Permissions — what each role can do.
Inviting a teammate
Add their email address, choose a role, and send the invite. They'll get an email to join. Until they accept, they sit under Pending Invites. You can change role on an existing member at any time.
Give people the least privilege they need. Day-to-day agents who answer the inbox rarely need access to billing or the WhatsApp connection. Reserve admin-level roles for the few who manage the account.
Team seats may be limited by your plan. If you hit an Upgrade prompt when inviting, you've reached your plan's seat count — see Billing & Wallet.
Security
Settings → Security covers your password and two-factor authentication.
API keys live in Integrations → Public API, alongside the request log and your usage against the plan — create them with a permission preset, see when each was last used, and rotate or revoke them there. A key's secret is shown once at creation and never again. Full detail is in the Authentication reference.
Activity — the audit log
Settings → Activity is an append-only record of sensitive actions: sign-ins, API key creation, member and role changes, data exports, and billing events, each with who did it and when. It's kept for 365 days. For Lynkist's platform-level security posture, see the Security page.
Export your data
Settings → Account → Export account data downloads everything in your workspace as a single ZIP archive. Admins only, and you'll be asked to confirm your password — the archive contains the whole account, not just your own records.
Building it takes a few minutes, so it runs in the background: start it, close the tab, and we'll email you when it's ready. The archive then stays available for 7 days, after which it's permanently deleted from our servers and you'd need to request a new one. You can request one export per day.
What's inside
Everything is UTF-8 CSV with a header row, timestamps are ISO 8601 in UTC, and structured columns contain JSON — so it opens in Excel, Sheets, pandas, or anything else.
| Folder | Contents |
|---|---|
data/ | Contacts, groups, notes, custom fields, conversations, message history, campaigns, templates, flows, QR codes, catalog, AI agent settings and knowledge sources, webhook endpoints and deliveries, notifications, support tickets |
account/ | Your organisation, team members, roles, pending invites, API key metadata, legal acceptances |
billing/ | Your invoices |
media/ | An index of every stored image, document and attachment |
manifest.json | Row counts, what was redacted, and every table we left out with the reason |
README.txt | A plain-language guide to the above |
What's deliberately left out
- Credentials — WhatsApp access tokens, API key secrets, webhook signing secrets, two-factor secrets, password hashes and the two-step PIN on your number. These never leave our database.
- Media files themselves. Attachments can run to gigabytes, so the archive indexes them rather
than bundling them. The
mediatable links each file back to its message. Contact support if you need the files exported. - Derived and platform data — the vector index built from your knowledge base (the source
documents are exported), Meta's published pricing tables, and our connector catalogue. None of
it is yours, and all of it is listed in
manifest.json.
Exporting is available on every plan, and on a paused workspace too — it's your data. It also keeps working after you've scheduled the account for deletion, right up until the grace period ends.
Webhooks — get events into your own systems
Webhooks let you receive a callback whenever something happens in your workspace (message delivered, reply received, and so on) so you can sync to your own systems. This is the build-your-own counterpart to a pre-built connector.
They live in the marketplace alongside the other connectors: Integrations → Webhooks → Manage. (Older bookmarks to Settings still work — they redirect.)
Adding an endpoint
- Click Add Endpoint.
- Enter your endpoint URL (must be HTTPS and publicly reachable).
- Add an optional description and any custom headers you need.
- Save — your endpoint appears under Active Endpoints with a health status: Healthy, Degraded, or Disabled.
Verifying payloads are really from Lynkist
Every delivery is signed. You get a signing secret at creation; use it to verify the
X-Lynkist-Signature header (an HMAC-SHA256 signature over the payload), alongside the
X-Lynkist-Timestamp header to reject replays. You can rotate the secret at any time.
Delivery rules to design for
- Respond with a 2xx within 10 seconds, or the delivery counts as failed.
- Failed deliveries retry on a backoff schedule: 1m, 5m, 30m, 2h, 6h.
- After 20 consecutive failures, the endpoint auto-disables — so monitor health and keep your receiver up.
For payload shapes, event types, and signature verification code, see the developer Webhooks reference.