LinkedIn OAuth app guide

VerifiedResearched 2026-10-28Confidence high

LinkedIn (Microsoft) · www.linkedin.com · Developer portal

Tier 3 · Review requiredCustomer-side gate

Sign-in and posting are self-serve. Reading analytics, Pages, or comments needs Community Management API vetting: two reviews, legal organizations only. Reading a member's own posts, feed, or messages is closed to everyone.

sourced

inferred

sourced

Customer-side gate: For Page features, the member needs a Page role: ADMINISTRATOR for management and analytics (rw_organization_admin), or a posting role. Roles are granted only in LinkedIn's UI. Personal posting has no admin gate.

App types (3)

Developer app with self-serve products (Sign In with LinkedIn using OpenID Connect, Share on LinkedIn): Start here. Any member can sign in and let your agent post, comment, and react. No review.
Separate app for the Community Management API: For post analytics, company Pages, or comments on Page posts. Request it on a new app with no other products. After Standard tier approval, add it to your main app with the approved app's client ID.
Native client with PKCE: Only for desktop or mobile apps that cannot keep a secret. Uses a loopback redirect. Ask your LinkedIn contact to turn PKCE on.

Docs read(reached)
Endpoints probed(reached)
Portal checked(reached)
Set up by a person(not reached)

Evidence: 0 tested, 3 probed, 42 sourced, 4 inferred

Generate a live guide to compare with this one.

Next step

Create a company Page You15 min

Create a LinkedIn company Page if you lack one. Make someone reachable a super admin.

0 of 16

What does your agent need?

Select everything it does. Scopes decide the tier.

5Your tier: GatedRequires a partner application, paid plan, or business approval. The provider can refuse.

This is the hardest marked scope. If lighter scopes cover your use case, you need tier 2 (Self-serve, optional review).

Start today

Composio-managed OAuth: Yes

sourced

Composio offers managed OAuth for LinkedIn, so you can prototype without your own app. Users see Composio on the consent screen, and you share its rate limits and default scopes. We could not confirm which products its app holds. LinkedIn Ads is a separate toolkit that needs your own app. If you switch auth configs, only new connections use it.

Time and effort

You can build while you wait.

Stage	Who can connect	Hands-on	Waiting	Review
Prototype (self-serve products)	Any member, with openid, profile, email, and w_member_social. No user cap. sourced profile, email, and w_member_social are open permissions any developer can add self-serve on the Products tab through Sign In with LinkedIn using OpenID Connect and Share on LinkedIn. Getting Access to LinkedIn APIs sourced · official docs · 2026-10-28 sourced Sign In with LinkedIn using OpenID Connect is requested on the Products tab, uses openid, profile, and email, returns an ID token, and does not verify identities. The docs sample shows issuer https://www.linkedin.com. Sign In with LinkedIn using OpenID Connect sourced · official docs · 2026-10-28 sourced Developer apps are tied to one LinkedIn Page that cannot be changed. Products for individual developers need a default Page. A Page super admin approves app verification and has 30 days. Associate an app with a LinkedIn Page sourced · official docs · 2026-10-28 sourced Applying for marketing API access starts with creating a LinkedIn Page, then a developer app, then applying on the Products tab. Page access cannot be granted through the API, only in the UI. Quick Start sourced · official docs · 2026-10-28 sourced Authorization codes last 30 minutes. All access tokens are issued with a 60-day lifespan. LinkedIn 3-Legged OAuth Flow sourced · official docs · 2026-10-28 sourced To refresh, you rerun the authorization flow; consent is skipped if the member is signed in and the token has not expired. Programmatic refresh tokens are available only to a limited set of partners. LinkedIn 3-Legged OAuth Flow sourced · official docs · 2026-10-28	1 h to 3 h	0 to 1 days	No
Community Management API, Development tier	Any member, within 500 calls a day per app and 100 per member. sourced Community Management APIs are only for registered legal organizations with commercial use cases. You must give a verified business email, legal name, registered address, website, and privacy policy; personal emails fail. Community Management App Review sourced · official docs · 2026-10-28 sourced Before the request, a super admin of your organization's Page must verify the app, and the app must not include LinkedIn or Microsoft names or logos. Community Management App Review sourced · official docs · 2026-10-28 sourced After a rejection at either tier, you cannot reapply with the same app. You create a new app and submit a new Development tier request. Community Management App Review sourced · official docs · 2026-10-28 sourced Community Management Development tier allows 500 calls per app and 100 per member per 24 hours, no BATCH_GET calls, no webhook push, and you must build your use cases within 12 months. Increasing Access sourced · official docs · 2026-10-28 sourced Developer apps are tied to one LinkedIn Page that cannot be changed. Products for individual developers need a default Page. A Page super admin approves app verification and has 30 days. Associate an app with a LinkedIn Page sourced · official docs · 2026-10-28 sourced A vendor blog reports that LinkedIn's Community Management application typically gets a first response in 2 to 6 weeks, and follow-up questions extend it. Why platform API reviews take weeks (not days), SocialRouter, Feb 2026 Vendor blog with no named author or dated LinkedIn case. Treat as rough. sourced · community · 2026-10-28 sourced LinkedIn selects partners at its discretion and may not upgrade a partner even if minimum requirements are met. Restricted APIs are evaluated case by case with no fixed timeline. Increasing Access sourced · official docs · 2026-10-28	3 h to 8 h	14 to 42 days	Yes
Community Management API, Standard tier	Any member, without Development tier limits. sourced Standard tier needs a fully integrated app, a company and product overview, test credentials, a valid privacy policy, and a screencast showing each use case. Later changes may need re-review. Community Management App Review sourced · official docs · 2026-10-28 sourced LinkedIn selects partners at its discretion and may not upgrade a partner even if minimum requirements are met. Restricted APIs are evaluated case by case with no fixed timeline. Increasing Access sourced · official docs · 2026-10-28 sourced A vendor blog reports that LinkedIn's Community Management application typically gets a first response in 2 to 6 weeks, and follow-up questions extend it. Why platform API reviews take weeks (not days), SocialRouter, Feb 2026 Vendor blog with no named author or dated LinkedIn case. Treat as rough. sourced · community · 2026-10-28 sourced An integrator's guide shows the Standard tier form asks for company details, use cases, customer questions, privacy policy, demo video, and test login, and that LinkedIn emails from developer-access@linkedin.com asking for a narrated walkthrough. Expertflow CX: Guide for Standard Tier Upgrade sourced · community · 2026-10-28	8 h to 24 h	14+ days	Yes

Prototype (self-serve products): The app is tied to the Page you pick at creation, for good. Tokens last 60 days with no refresh token.
Community Management API, Development tier: No batch calls or webhooks. LinkedIn publishes no timeline; 2 to 6 weeks for a first response comes from one vendor blog. Your Page super admin has up to 30 days to verify the app. A rejection means starting over with a new app.
Community Management API, Standard tier: Build every claimed use case, then send a screencast and test credentials. LinkedIn may still decline. No timeline is published. Plan for weeks.

Scopes

Scopes that match your selection are marked.

Sign-in and basic profileNo review · Read data
openid profile email
Self-serve. Name, photo, and primary email, which is sometimes missing. This is all a self-serve app can read.
sourced
profile, email, and w_member_social are open permissions any developer can add self-serve on the Products tab through Sign In with LinkedIn using OpenID Connect and Share on LinkedIn.
Getting Access to LinkedIn APIs
sourced · official docs · 2026-10-28
sourced
Sign In with LinkedIn using OpenID Connect is requested on the Products tab, uses openid, profile, and email, returns an ID token, and does not verify identities. The docs sample shows issuer https://www.linkedin.com.
Sign In with LinkedIn using OpenID Connect
sourced · official docs · 2026-10-28
probed
LinkedIn's OpenID discovery document is live. It lists issuer https://www.linkedin.com/oauth, response type code only, and scopes openid, profile, email.
LinkedIn OpenID Connect discovery document
Unauthenticated GET, HTTP 200, JSON. Also lists jwks_uri https://www.linkedin.com/oauth/openid/jwks and userinfo https://api.linkedin.com/v2/userinfo.
probed · probe · 2026-10-28
Post, comment, and react as the memberNo review · Write data
w_member_social
Self-serve. 150 requests per member per day. You cannot read posts back.
sourced
profile, email, and w_member_social are open permissions any developer can add self-serve on the Products tab through Sign In with LinkedIn using OpenID Connect and Share on LinkedIn.
Getting Access to LinkedIn APIs
sourced · official docs · 2026-10-28
sourced
Share on LinkedIn grants w_member_social for creating posts through the UGC Posts API, limited to 150 requests per member and 100,000 per app per day.
Share on LinkedIn
sourced · official docs · 2026-10-28
Background access (refresh tokens)Review · Act while offline
refresh_token grant (programmatic refresh tokens)
Self-serve apps get no refresh token. Approved Marketing Developer Platform partners get one, which dies 365 days after first consent.
sourced
To refresh, you rerun the authorization flow; consent is skipped if the member is signed in and the token has not expired. Programmatic refresh tokens are available only to a limited set of partners.
LinkedIn 3-Legged OAuth Flow
sourced · official docs · 2026-10-28
sourced
Programmatic refresh tokens are offered to approved Marketing Developer Platform partners. They last 365 days from the first consent and refreshing does not extend them; LinkedIn can revoke them at any time.
Refresh Tokens with OAuth 2.0
sourced · official docs · 2026-10-28
inferred
A self-serve agent cannot act for a member for more than 60 days without the member coming back through a browser.
From e5 and e6: 60-day tokens, refresh only by rerunning the browser flow, programmatic refresh limited to approved partners (e8).
inferred · reasoning · 2026-10-28
Analytics, comments, and Page management (Community Management API)Review · Read data, Write data, Admin-level
r_member_postAnalytics r_member_profileAnalytics w_member_social_feed r_organization_social w_organization_social rw_organization_admin
Adds vetting, a business email, a legal entity, Page verification, and a screencast review. Data retention limits apply, and data shows only inside your app.
sourced
Community Management grants scopes including r_member_postAnalytics, r_member_profileAnalytics, w_member_social_feed, r_organization_social, w_organization_social, and rw_organization_admin.
Increasing Access
sourced · official docs · 2026-10-28
sourced
Community Management covers Page management, Page analytics, member follower and post statistics, and posting, commenting, and reacting for individual profiles.
Community Management - Overview
sourced · official docs · 2026-10-28
sourced
Community Management APIs are only for registered legal organizations with commercial use cases. You must give a verified business email, legal name, registered address, website, and privacy policy; personal emails fail.
Community Management App Review
sourced · official docs · 2026-10-28
sourced
Standard tier needs a fully integrated app, a company and product overview, test credentials, a valid privacy policy, and a screencast showing each use case. Later changes may need re-review.
Community Management App Review
sourced · official docs · 2026-10-28
sourced
Marketing API member data may only be used to manage Pages or profiles, shown only in your app, not exported or combined with other data, not used for sales, recruiting, or ads. Social activity may be stored 48 hours and most profile data 24 hours.
Restricted Uses of LinkedIn Marketing APIs and Data
sourced · official policy · 2026-10-28
sourced
rw_organization_admin only works on organizations where the member has the ADMINISTRATOR role; members need the right Page roles to act on Page data.
Increasing Access
sourced · official docs · 2026-10-28
sourced
Storage limits differ by data type: other members' profile data may be cached 24 hours at most, member social activity stored 48 hours, organization social activity six weeks (six months for an organization that authenticated), Page admin and reporting data one year, and the authenticated member's own basic profile has no time limit. The shortest limit applies when rules overlap.
LinkedIn Marketing API Program Data Storage Requirements
sourced · official policy · 2026-10-28
Read the member's own posts and feedPartner only · Read data
r_member_social
Closed to new requests.
sourced
r_member_social, which reads a member's posts, is a closed permission and LinkedIn is not accepting access requests.
Community Management - Overview (FAQ 6)
LinkedIn cites resource constraints.
sourced · official docs · 2026-10-28
Sales Navigator, Talent, Compliance, and restricted marketing dataPartner only · Read data, Admin-level
r_sales_nav_profiles r_sales_nav_analytics r_compliance Audience Insights
Separate partner programs with no fixed timeline. Compliance and Company Intelligence are closed to new applicants.
sourced
Sales Navigator permissions need approval as a SNAP partner, and Talent integrations need a separate partner application.
Getting Access to LinkedIn APIs
sourced · official docs · 2026-10-28
sourced
Most LinkedIn permissions and partner programs need explicit approval. Compliance permissions are closed and cannot be requested.
Getting Access to LinkedIn APIs
sourced · official docs · 2026-10-28
sourced
Company Intelligence API is not accepting new applications. Audience Insights and Media Planning need extra criteria. Boost permissions arrived in version 202610.
Increasing Access
sourced · official docs · 2026-10-28
sourced
LinkedIn selects partners at its discretion and may not upgrade a partner even if minimum requirements are met. Restricted APIs are evaluated case by case with no fixed timeline.
Increasing Access
sourced · official docs · 2026-10-28

Requirements

Steps

Prototype

Create a company PageYou15 min
Create a LinkedIn company Page if you lack one. Make someone reachable a super admin.
sourced
Applying for marketing API access starts with creating a LinkedIn Page, then a developer app, then applying on the Products tab. Page access cannot be granted through the API, only in the UI.
Quick Start
sourced · official docs · 2026-10-28
sourced
Developer apps are tied to one LinkedIn Page that cannot be changed. Products for individual developers need a default Page. A Page super admin approves app verification and has 30 days.
Associate an app with a LinkedIn Page
sourced · official docs · 2026-10-28
Create the developer appYou10 to 20 min
Open linkedin.com/developers/apps/new. Enter an app name, select your Page, add a privacy policy URL and logo, and accept the API terms.
https://www.linkedin.com/developers/apps/new
sourced
Applying for marketing API access starts with creating a LinkedIn Page, then a developer app, then applying on the Products tab. Page access cannot be granted through the API, only in the UI.
Quick Start
sourced · official docs · 2026-10-28
probed
Developer portal at linkedin.com/developers/apps is live and returns the portal page shell to a signed-out request.
Developers | LinkedIn
HTTP 200, page title Developers | LinkedIn, JavaScript app shell. We did not sign in, so the app form itself was not seen.
probed · probe · 2026-10-28
sourced
Before the request, a super admin of your organization's Page must verify the app, and the app must not include LinkedIn or Microsoft names or logos.
Community Management App Review
sourced · official docs · 2026-10-28
Add the self-serve productsYou5 min
On the Products tab, request Sign In with LinkedIn using OpenID Connect and Share on LinkedIn. The Auth tab then lists openid, profile, email, and w_member_social.
https://www.linkedin.com/developers/apps
sourced
profile, email, and w_member_social are open permissions any developer can add self-serve on the Products tab through Sign In with LinkedIn using OpenID Connect and Share on LinkedIn.
Getting Access to LinkedIn APIs
sourced · official docs · 2026-10-28
sourced
Sign In with LinkedIn using OpenID Connect is requested on the Products tab, uses openid, profile, and email, returns an ID token, and does not verify identities. The docs sample shows issuer https://www.linkedin.com.
Sign In with LinkedIn using OpenID Connect
sourced · official docs · 2026-10-28
sourced
Share on LinkedIn grants w_member_social for creating posts through the UGC Posts API, limited to 150 requests per member and 100,000 per app per day.
Share on LinkedIn
sourced · official docs · 2026-10-28
Add redirect URL and copy credentialsYou5 min
On the Auth tab, add your callback URL, such as Composio's. Copy the client ID and client secret to your secret store.
sourced
Redirect URLs are added over HTTPS on the Auth tab, must be absolute, ignore query parameters, and cannot contain #. A mismatch returns 401 Redirect_uri doesn't match.
LinkedIn 3-Legged OAuth Flow
sourced · official docs · 2026-10-28
Build the code flowAgent2 to 4 hours
Send members to https://www.linkedin.com/oauth/v2/authorization with response_type=code, state, and scope=openid profile email w_member_social. Exchange the code within 30 minutes. Validate the ID token against the live discovery document.
https://www.linkedin.com/oauth/.well-known/openid-configuration
sourced
Authorization codes last 30 minutes. All access tokens are issued with a 60-day lifespan.
LinkedIn 3-Legged OAuth Flow
sourced · official docs · 2026-10-28
probed
LinkedIn's OpenID discovery document is live. It lists issuer https://www.linkedin.com/oauth, response type code only, and scopes openid, profile, email.
LinkedIn OpenID Connect discovery document
Unauthenticated GET, HTTP 200, JSON. Also lists jwks_uri https://www.linkedin.com/oauth/openid/jwks and userinfo https://api.linkedin.com/v2/userinfo.
probed · probe · 2026-10-28
sourced
Sign In with LinkedIn using OpenID Connect is requested on the Products tab, uses openid, profile, and email, returns an ID token, and does not verify identities. The docs sample shows issuer https://www.linkedin.com.
Sign In with LinkedIn using OpenID Connect
sourced · official docs · 2026-10-28
inferred
Hard-coding the issuer from LinkedIn's docs sample will fail ID token validation.
The live discovery document (e10) gives issuer https://www.linkedin.com/oauth; the docs sample (e13) shows https://www.linkedin.com. We did not validate a real ID token.
inferred · reasoning · 2026-10-28
Build a reconnect promptAgent1 to 2 hours
Store expires_in and prompt a reconnect a few days before expiry. Send 401s back through sign-in. A changed scope set invalidates earlier tokens.
sourced
To refresh, you rerun the authorization flow; consent is skipped if the member is signed in and the token has not expired. Programmatic refresh tokens are available only to a limited set of partners.
LinkedIn 3-Legged OAuth Flow
sourced · official docs · 2026-10-28
sourced
Members must accept all requested scopes or none. Requesting a different scope set than before invalidates the member's previous access tokens.
LinkedIn 3-Legged OAuth Flow
sourced · official docs · 2026-10-28
inferred
A self-serve agent cannot act for a member for more than 60 days without the member coming back through a browser.
From e5 and e6: 60-day tokens, refresh only by rerunning the browser flow, programmatic refresh limited to approved partners (e8).
inferred · reasoning · 2026-10-28

Limited beta

Check your use caseAgent30 min
Read the restricted uses page. LinkedIn refuses sales prospecting, recruiting, CRM enrichment, and feed displays. List only use cases you will build.
https://learn.microsoft.com/en-us/linkedin/marketing/restricted-use-cases
sourced
Marketing API member data may only be used to manage Pages or profiles, shown only in your app, not exported or combined with other data, not used for sales, recruiting, or ads. Social activity may be stored 48 hours and most profile data 24 hours.
Restricted Uses of LinkedIn Marketing APIs and Data
sourced · official policy · 2026-10-28
sourced
Community Management data cannot be used for social feed displays, and fake or headless profiles are not allowed.
Restricted Uses of LinkedIn Marketing APIs and Data
sourced · official policy · 2026-10-28
Create a second appYou15 min
Create a new app on the same Page with no products, for the Community Management request.
https://www.linkedin.com/developers/apps/new
sourced
Community Management Development tier can only be requested on a new app with no other API products; otherwise the option is grayed out.
Community Management - Overview (FAQ 1 and 4)
sourced · official docs · 2026-10-28
Get Page verificationYou10 min plus up to 30 days for the admin
On the app's Settings tab, start Page verification and send the link to a Page super admin. Use the draft note.
https://www.linkedin.com/help/linkedin/answer/a548360/associate-an-app-with-a-linkedin-page?lang=en
sourced
Developer apps are tied to one LinkedIn Page that cannot be changed. Products for individual developers need a default Page. A Page super admin approves app verification and has 30 days.
Associate an app with a LinkedIn Page
sourced · official docs · 2026-10-28
sourced
Before the request, a super admin of your organization's Page must verify the app, and the app must not include LinkedIn or Microsoft names or logos.
Community Management App Review
sourced · official docs · 2026-10-28
Submit the Development tier requestYou45 to 90 min
On the Products tab, request Community Management API. Fill every field and click the business email verification link (check spam). Use the use-case draft.
https://learn.microsoft.com/en-us/linkedin/marketing/community-management-app-review
sourced
Community Management APIs are only for registered legal organizations with commercial use cases. You must give a verified business email, legal name, registered address, website, and privacy policy; personal emails fail.
Community Management App Review
sourced · official docs · 2026-10-28
sourced
Before the request, a super admin of your organization's Page must verify the app, and the app must not include LinkedIn or Microsoft names or logos.
Community Management App Review
sourced · official docs · 2026-10-28
Wait for the Development tier decisionProvider (wait)2 to 6 weeks (developer-reported)
LinkedIn checks the use case, email, organization, domain, and Page verification. If rejected, start again with a new app.
sourced
After a rejection at either tier, you cannot reapply with the same app. You create a new app and submit a new Development tier request.
Community Management App Review
sourced · official docs · 2026-10-28
sourced
LinkedIn selects partners at its discretion and may not upgrade a partner even if minimum requirements are met. Restricted APIs are evaluated case by case with no fixed timeline.
Increasing Access
sourced · official docs · 2026-10-28
sourced
A vendor blog reports that LinkedIn's Community Management application typically gets a first response in 2 to 6 weeks, and follow-up questions extend it.
Why platform API reviews take weeks (not days), SocialRouter, Feb 2026
Vendor blog with no named author or dated LinkedIn case. Treat as rough.
sourced · community · 2026-10-28

Production

Build every claimed use caseAgent1 to 3 days
Use the /rest/ versioned endpoints with a Linkedin-Version header. Stay within 500 calls a day and enforce the data retention limits.
sourced
Community Management Development tier allows 500 calls per app and 100 per member per 24 hours, no BATCH_GET calls, no webhook push, and you must build your use cases within 12 months.
Increasing Access
sourced · official docs · 2026-10-28
sourced
Marketing API versions ship monthly, are supported at least one year, and every call needs a Linkedin-Version header; missing or deprecated versions return errors. Version 202511 sunsets November 16, 2026.
LMS API Documentation Versioning
sourced · official docs · 2026-10-28
sourced
Marketing API member data may only be used to manage Pages or profiles, shown only in your app, not exported or combined with other data, not used for sales, recruiting, or ads. Social activity may be stored 48 hours and most profile data 24 hours.
Restricted Uses of LinkedIn Marketing APIs and Data
sourced · official policy · 2026-10-28
sourced
Storage limits differ by data type: other members' profile data may be cached 24 hours at most, member social activity stored 48 hours, organization social activity six weeks (six months for an organization that authenticated), Page admin and reporting data one year, and the authenticated member's own basic profile has no time limit. The shortest limit applies when rules overlap.
LinkedIn Marketing API Program Data Storage Requirements
sourced · official policy · 2026-10-28
Record the screencastYou1 to 2 hours
For each use case, show the OAuth flow, posting, how comments appear, and which profile fields you display. Narrate in English. See the shot list draft.
sourced
Standard tier needs a fully integrated app, a company and product overview, test credentials, a valid privacy policy, and a screencast showing each use case. Later changes may need re-review.
Community Management App Review
sourced · official docs · 2026-10-28
sourced
An integrator's guide shows the Standard tier form asks for company details, use cases, customer questions, privacy policy, demo video, and test login, and that LinkedIn emails from developer-access@linkedin.com asking for a narrated walkthrough.
Expertflow CX: Guide for Standard Tier Upgrade
sourced · community · 2026-10-28
Submit the Standard tier formYou1 hour
Under My Apps, Products, open the Standard tier form. Add an overview, use cases, privacy policy, reviewer test login, and screencast. Watch for mail from developer-access@linkedin.com.
sourced
Standard tier needs a fully integrated app, a company and product overview, test credentials, a valid privacy policy, and a screencast showing each use case. Later changes may need re-review.
Community Management App Review
sourced · official docs · 2026-10-28
sourced
An integrator's guide shows the Standard tier form asks for company details, use cases, customer questions, privacy policy, demo video, and test login, and that LinkedIn emails from developer-access@linkedin.com asking for a narrated walkthrough.
Expertflow CX: Guide for Standard Tier Upgrade
sourced · community · 2026-10-28
Wait for the Standard tier decisionProvider (wait)2 weeks to unknown
LinkedIn may approve, ask questions, or decline. If declined, start over at the Development tier.
sourced
LinkedIn selects partners at its discretion and may not upgrade a partner even if minimum requirements are met. Restricted APIs are evaluated case by case with no fixed timeline.
Increasing Access
sourced · official docs · 2026-10-28
sourced
After a rejection at either tier, you cannot reapply with the same app. You create a new app and submit a new Development tier request.
Community Management App Review
sourced · official docs · 2026-10-28
sourced
A vendor blog reports that LinkedIn's Community Management application typically gets a first response in 2 to 6 weeks, and follow-up questions extend it.
Why platform API reviews take weeks (not days), SocialRouter, Feb 2026
Vendor blog with no named author or dated LinkedIn case. Treat as rough.
sourced · community · 2026-10-28
Connect your app to ComposioYou20 min
Create a LinkedIn auth config with your client ID and client secret, and add Composio's callback URL to the Auth tab. Ask existing users to reconnect.
https://docs.composio.dev/docs/white-labeling-authentication
sourced
A custom Composio auth config applies only to new connections. Existing connections stay on their original auth config until the user reconnects or credentials are imported.
White-labeling authentication
sourced · composio docs · 2026-10-28
sourced
Reasons to use your own OAuth app with Composio: your name on the consent screen, custom scopes, your own rate limit instead of a shared quota, and faster trigger polling than the 15-minute managed minimum.
Custom app vs managed app
sourced · composio docs · 2026-10-28

Blockers

Invalid scope error for r_member_social, r_liteprofile, or another scope.
Cause: Your app lacks the product for that scope, or the scope is closed.
Fix: Request only scopes listed on your Auth tab.
Help: LinkedIn Developer Support: https://www.linkedin.com/help/linkedin/ask/dsapi
sourced
r_member_social, which reads a member's posts, is a closed permission and LinkedIn is not accepting access requests.
Community Management - Overview (FAQ 6)
LinkedIn cites resource constraints.
sourced · official docs · 2026-10-28
sourced
profile, email, and w_member_social are open permissions any developer can add self-serve on the Products tab through Sign In with LinkedIn using OpenID Connect and Share on LinkedIn.
Getting Access to LinkedIn APIs
sourced · official docs · 2026-10-28
sourced
Community Management grants scopes including r_member_postAnalytics, r_member_profileAnalytics, w_member_social_feed, r_organization_social, w_organization_social, and rw_organization_admin.
Increasing Access
sourced · official docs · 2026-10-28
The Community Management API request is grayed out.
Cause: The app already has other products.
Fix: Request it on a new app with no products.
sourced
Community Management Development tier can only be requested on a new app with no other API products; otherwise the option is grayed out.
Community Management - Overview (FAQ 1 and 4)
sourced · official docs · 2026-10-28
sourced
Standard tier needs a fully integrated app, a company and product overview, test credentials, a valid privacy policy, and a screencast showing each use case. Later changes may need re-review.
Community Management App Review
sourced · official docs · 2026-10-28
Your tier request is rejected.
Cause: Often a personal email, a mismatched name or domain, an unverified app, a restricted use case, or an incomplete screencast.
Fix: Fix the cause and submit from a new app.
Help: LinkedIn Developer Support: https://www.linkedin.com/help/linkedin/ask/dsapi
sourced
After a rejection at either tier, you cannot reapply with the same app. You create a new app and submit a new Development tier request.
Community Management App Review
sourced · official docs · 2026-10-28
sourced
Community Management APIs are only for registered legal organizations with commercial use cases. You must give a verified business email, legal name, registered address, website, and privacy policy; personal emails fail.
Community Management App Review
sourced · official docs · 2026-10-28
sourced
Marketing API member data may only be used to manage Pages or profiles, shown only in your app, not exported or combined with other data, not used for sales, recruiting, or ads. Social activity may be stored 48 hours and most profile data 24 hours.
Restricted Uses of LinkedIn Marketing APIs and Data
sourced · official policy · 2026-10-28
Calls fail with 401 after 60 days.
Cause: Self-serve apps get no refresh token.
Fix: Prompt members to reconnect before expiry.
sourced
Authorization codes last 30 minutes. All access tokens are issued with a 60-day lifespan.
LinkedIn 3-Legged OAuth Flow
sourced · official docs · 2026-10-28
sourced
To refresh, you rerun the authorization flow; consent is skipped if the member is signed in and the token has not expired. Programmatic refresh tokens are available only to a limited set of partners.
LinkedIn 3-Legged OAuth Flow
sourced · official docs · 2026-10-28
sourced
Programmatic refresh tokens are offered to approved Marketing Developer Platform partners. They last 365 days from the first consent and refreshing does not extend them; LinkedIn can revoke them at any time.
Refresh Tokens with OAuth 2.0
sourced · official docs · 2026-10-28
401 Redirect_uri doesn't match, or invalid_redirect_uri on the token call.
Cause: The redirect URI differs from the Auth tab, or the code is older than 30 minutes.
Fix: Send the exact registered URL on both calls and exchange the code right away.
sourced
Redirect URLs are added over HTTPS on the Auth tab, must be absolute, ignore query parameters, and cannot contain #. A mismatch returns 401 Redirect_uri doesn't match.
LinkedIn 3-Legged OAuth Flow
sourced · official docs · 2026-10-28
sourced
Authorization codes last 30 minutes. All access tokens are issued with a 60-day lifespan.
LinkedIn 3-Legged OAuth Flow
sourced · official docs · 2026-10-28
403 Not enough permissions on organization statistics.
Cause: rw_organization_admin was not requested, or the member is not a Page ADMINISTRATOR.
Fix: Request rw_organization_admin and check the member's role with organizationAcls.
sourced
A developer with Development tier access got 403 Not enough permissions on follower statistics because the OAuth client requested fewer scopes than the app held; requesting rw_organization_admin fixed it.
n8n community: Issue with LinkedIn Community Management scopes (Nov 2024)
sourced · community · 2026-10-28
sourced
rw_organization_admin only works on organizations where the member has the ADMINISTRATOR role; members need the right Page roles to act on Page data.
Increasing Access
sourced · official docs · 2026-10-28
sourced
Applying for marketing API access starts with creating a LinkedIn Page, then a developer app, then applying on the Products tab. Page access cannot be granted through the API, only in the UI.
Quick Start
sourced · official docs · 2026-10-28
429 responses, or a 75 percent quota email.
Cause: Daily app or member limits, which reset at midnight UTC.
Fix: Check limits on the Analytics tab, cache within the rules, and apply for Standard tier.
sourced
Rate limits are daily per app and per member, reset at midnight UTC, are not published, and appear on the app's Analytics tab. Over-limit calls get 429; admins get an email at 75 percent of app quota.
LinkedIn API Rate Limiting
sourced · official docs · 2026-10-28
sourced
Community Management Development tier allows 500 calls per app and 100 per member per 24 hours, no BATCH_GET calls, no webhook push, and you must build your use cases within 12 months.
Increasing Access
sourced · official docs · 2026-10-28
/rest/ calls fail with a missing or deprecated version error.
Cause: No Linkedin-Version header, or a version past one year.
Fix: Send Linkedin-Version: YYYYMM with a current version.
sourced
Marketing API versions ship monthly, are supported at least one year, and every call needs a Linkedin-Version header; missing or deprecated versions return errors. Version 202511 sunsets November 16, 2026.
LMS API Documentation Versioning
sourced · official docs · 2026-10-28
ID token validation fails on the issuer.
Cause: The live issuer is https://www.linkedin.com/oauth, but the docs sample shows https://www.linkedin.com.
Fix: Read the issuer and JWKS URL from the live discovery document.
probed
LinkedIn's OpenID discovery document is live. It lists issuer https://www.linkedin.com/oauth, response type code only, and scopes openid, profile, email.
LinkedIn OpenID Connect discovery document
Unauthenticated GET, HTTP 200, JSON. Also lists jwks_uri https://www.linkedin.com/oauth/openid/jwks and userinfo https://api.linkedin.com/v2/userinfo.
probed · probe · 2026-10-28
sourced
Sign In with LinkedIn using OpenID Connect is requested on the Products tab, uses openid, profile, and email, returns an ID token, and does not verify identities. The docs sample shows issuer https://www.linkedin.com.
Sign In with LinkedIn using OpenID Connect
sourced · official docs · 2026-10-28
inferred
Hard-coding the issuer from LinkedIn's docs sample will fail ID token validation.
The live discovery document (e10) gives issuer https://www.linkedin.com/oauth; the docs sample (e13) shows https://www.linkedin.com. We did not validate a real ID token.
inferred · reasoning · 2026-10-28
The Page super admin never approves verification.
Cause: The request waits on a person with 30 days to act.
Fix: Send the draft note and resend if it lapses.
sourced
Developer apps are tied to one LinkedIn Page that cannot be changed. Products for individual developers need a default Page. A Page super admin approves app verification and has 30 days.
Associate an app with a LinkedIn Page
sourced · official docs · 2026-10-28

Agent and you

Agent did

Read about 21 official LinkedIn, Composio, and community pages.
Fetched the live OpenID discovery document at /oauth/.well-known/openid-configuration: only openid, profile, and email.
Probed authorize with a bad client ID: live, invalid client_id error page.
Checked linkedin.com/developers/apps: it serves the portal shell when signed out.
Drafted a use-case description, a Page admin note, a screencast script, a data checklist, and a support email.

Agent can do

Write the code flow, ID token validation, and reconnect prompt.
Write 24-hour and 48-hour deletion jobs.
Add the Linkedin-Version header and an upgrade reminder.
Fill the app and access forms in a browser after you sign in.
Tailor the drafts to what you built.

You must do

Sign in to LinkedIn and pass 2FA.
Create the Page and choose a super admin.
Get the app verification approved.
Verify your business email and legal entity.
Publish a privacy policy.
Record the screencast and provide test credentials.
Accept the LinkedIn API and Marketing API terms.

Drafts

Community Management API use-case description draft · app description

[Company legal name] builds [product], an assistant that helps professionals and marketing teams manage their LinkedIn presence. With consent, [product] drafts posts the member approves, publishes them to their profile or Pages they administer, and shows how they performed (impressions, reactions, comments, shares).

Use cases:
1. Profile management: publish approved posts and reply to comments on them.
2. Page management: publish to Pages where the member is an ADMINISTRATOR and show comments in our app.
3. Analytics: show post and Page statistics to the member and Page admins only.

Data handling: LinkedIn data appears only in our app, only to the member or Page admins. We delete member social activity within 48 hours and other members' profile data within 24 hours. We do not export or combine LinkedIn data, or use it for sales, recruiting, lead generation, or ad targeting.

Permissions: w_member_social, r_member_postAnalytics, w_organization_social, r_organization_social, rw_organization_admin. Nothing else.

Note to your Page super admin draft · other

Hi [name],

We are applying for LinkedIn's Community Management API for [product]. LinkedIn needs a super admin of [Page name] to confirm the developer app is ours.

Steps (about 2 minutes):
1. Sign in to LinkedIn.
2. Open [paste the link from the app's Settings tab].
3. Check the app is [app name] and the Page is [Page name], then click Verify.

The link expires in 30 days. It does not give the app access to your account.

Thanks,
[your name]

Standard tier screencast shot list draft · demo video script

Close every other window. Record in high resolution and narrate in English.
1. Show your app's home screen and say what it does.
2. Click Connect LinkedIn, show the consent screen, and click Allow.
3. Profile management: draft, approve, and publish a post. Show it on LinkedIn.
4. Comment from another account. Show where the comment appears and which commenter fields you display.
5. Page management: publish a post to a Page the user administers.
6. Analytics: show the post and Page statistics.
7. State retention (48 hours for member posts and comments, 24 hours for other members' profiles, one year for Page analytics) and who can see the data.
8. Say if a listed use case is missing.

- Name LinkedIn as a source and list the fields you read.
- State retention: member social activity 48 hours, other members' profiles 24 hours, Page analytics one year.
- State that only the member or Page admins see the data.
- State that you do not sell, export, or combine LinkedIn data, or use it for sales, recruiting, or ads.
- Explain how to disconnect and how you delete data.
- Give a contact email on your domain.
- Host the policy on your access request's website domain.

Question to LinkedIn Developer Support draft · support email

Subject: Community Management API: refresh tokens and review status for app [client ID]

Hello,

We submitted a Development tier request for app [client ID] on [date] for [company legal name].

1. What is the status, and is anything missing?
2. Will programmatic refresh tokens be enabled on approval, or is that separate?
3. Members approve each post before we publish it. Is that within the Community Management terms?

Thank you,
[name], [role], [company]

Open questions

How long do tier reviews take?
The only figure is from an unattributed February 2026 vendor blog.
To resolve: Submit a request and log the dates.
Does approval include programmatic refresh tokens?
No page says Development tier apps get them.
To resolve: Check the token response for refresh_token after approval.
Do self-serve products need Page verification?
We could not open the signed-in app form.
To resolve: Test Sign In and Share on LinkedIn before verifying.
Which scopes does Composio's managed app hold?
Composio's managed-auth table does not list them.
To resolve: Connect a test account and inspect the granted scopes.
Do LinkedIn's API terms limit AI use of content?
We did not read the full API or Marketing API terms.
To resolve: Read https://www.linkedin.com/legal/l/api-terms-of-use and the Marketing API Terms before launch.
When did recent Community Management changes ship?
The docs list new analytics scopes and higher limits without dates.
To resolve: Check LinkedIn's Recent Changes page.

Sources

Getting Access to LinkedIn APIs official docs · 2026-10-28
LinkedIn 3-Legged OAuth Flow official docs · 2026-10-28
Refresh Tokens with OAuth 2.0 official docs · 2026-10-28
Authenticating with OAuth 2.0 for Native Clients official docs · 2026-10-28
LinkedIn OpenID Connect discovery document probe · 2026-10-28
LinkedIn authorize endpoint probe · 2026-10-28
Developers | LinkedIn probe · 2026-10-28
Sign In with LinkedIn using OpenID Connect official docs · 2026-10-28
Associate an app with a LinkedIn Page official docs · 2026-10-28
Community Management - Overview official docs · 2026-10-28
Community Management App Review official docs · 2026-10-28
Increasing Access official docs · 2026-10-28
Restricted Uses of LinkedIn Marketing APIs and Data official policy · 2026-10-28
Quick Start official docs · 2026-10-28
LMS API Documentation Versioning official docs · 2026-10-28
LinkedIn API Rate Limiting official docs · 2026-10-28
Share on LinkedIn official docs · 2026-10-28
Composio managed auth toolkits composio docs · 2026-10-28
White-labeling authentication composio docs · 2026-10-28
Custom app vs managed app composio docs · 2026-10-28
Why platform API reviews take weeks (not days), SocialRouter, Feb 2026 community · 2026-10-28
Expertflow CX: Guide for Standard Tier Upgrade community · 2026-10-28
n8n community: Issue with LinkedIn Community Management scopes (Nov 2024) community · 2026-10-28
LinkedIn Marketing API Program Data Storage Requirements official policy · 2026-10-28
Key Concepts (Company Page Roles) official docs · 2026-10-28
Community Management API, LinkedIn Developer product catalog official docs · 2026-10-28
LinkedIn API developer guide, Upload-Post community · 2026-10-28
Composio LinkedIn toolkit composio docs · 2026-10-28

Verification changes

Rewrote the data storage limits in r11, the Community Management scope tier, s12, and three drafts. They now separate member social activity (48 hours), other members' profile data (24 hours), the connected member's own profile (no limit), and Page analytics (one year).
The guide said all data you read is limited to 24 to 48 hours. LinkedIn's Data Storage Requirements table sets different limits per data type, and Page reporting data may be kept one year. 2026-10-28
Narrowed the customer-side gate note: ADMINISTRATOR is needed for rw_organization_admin, while posting as the Page also works for a few other roles.
LinkedIn's Key Concepts page lists ADMINISTRATOR, DIRECT_SPONSORED_CONTENT_POSTER, and LEAD_GEN_FORMS_MANAGER for w_organization_social. 2026-10-28
Added two independent sources to the tier 3 verdict.
Verification asks for a second source on tier-deciding claims. LinkedIn's product catalog page and a vendor guide both describe the vetted Community Management review. 2026-10-28
Narrowed the Community Management app type: the no-other-products rule applies to the Development tier request. After Standard tier approval, LinkedIn lets you add the product to an existing app.
Community Management overview FAQ 1, 4, and 5, and the app review page. 2026-10-28
Limited stage notes now say the 2 to 6 weeks is for a first response only, and that follow-up questions add time.
The vendor blog gives 2 to 6 weeks for an initial response and says follow-ups extend it. 2026-10-28
Production stage notes no longer say developers report weeks for the Standard tier.
No source found gives a Standard tier timeline. The integrator guide (e38) gives none. The 14 day minimum stays as an estimate. 2026-10-28
Fixed the review-time uncertainty: the vendor blog is dated (12 February 2026); it only lacks a named author.
Re-fetched the blog page, which shows the date. 2026-10-28
Added Composio's LinkedIn toolkit page to the Composio section.
It confirms managed OAuth and a shared, rate-limited default app, and does not list default scopes, which matches the open uncertainty. 2026-10-28
Composio note: replaced "When you switch to your own auth config, only new connections use it; existing users stay on the managed app until they reconnect." with the switching rule as Composio states it, including importing credentials.
A reviewer cross-checked Composio's docs: existing users stay on the old connection until they re-authenticate or you import their credentials, so "must reconnect" overstated it. 2026-10-28