Merge pull request #1880 from codatio/update/secure-linking-getting-started

Update "How to get started" on the secure linking update

Author: Rachel-Codat

blog/250110-secure-linking.md

@@ -30,7 +30,10 @@ All clients who want to have stricter rules around Link URLs sent to their custo
 
 ## How to get started?
 
-Contact your Codat account manager with the request to enable one-time Link URLs. Depending on the type of the Link flow you are using, you also need to action the following:
+To set up one-time Link URLs:
+
+1. **Enable the One-time Link URLs setting** in the [Codat Portal](https://app.codat.io) under **[Settings > Auth flow > Link > Onboarding](https://app.codat.io/settings/link-settings/onboarding)**.
+2. **Complete the additional steps for your Link flow**, as described below.
 
 #### If using Hosted Link
 
@@ -42,4 +45,10 @@ If you are currently adding query parameters to Link URLs (for example, by appen
 
 #### If using Link SDK
 
-To enforce the limited validity of Link URLs using the Link SDK, you need to retrieve an access token for your customer using the [Get company access token](/platform-api#/operations/get-company-access-token) endpoint and pass it when initializing the SDK. This serves as an equivalent to a one-time password appended to a Link URL.
+The Link SDK uses an access token instead of an appended one-time password. To set this up:
+
+1. **Register your domain** using the [Set CORS settings](/platform-api#/operations/set-cors-settings) endpoint so the component can make authenticated requests from your site.
+2. **Get a company access token.** Retrieve it server-side from the [Get company access token](/platform-api#/operations/get-company-access-token) endpoint (`GET /companies/{companyId}/accessToken`). Tokens are valid for 24 hours and scoped to a single company.
+3. **Pass the token to the Link SDK** via the `accessToken` prop when initializing the component.
+
+Reach out to your account manager or our support team if you'd like help getting set up.