LinkedIn API Integration: OAuth2, Posting, and Profile

LinkedIn API Integration: OAuth2, Posting, and Profile

Typical scenario: a B2B product requires LinkedIn authorization for passwordless login, or needs automatic news posting on behalf of the company. We have implemented LinkedIn API on 12 projects for B2B companies. A common mistake is forgetting the state parameter, opening a CSRF vulnerability. An incorrect redirect URI breaks the OAuth flow. LinkedIn API v2 strictly regulates access. For simple OAuth2, app registration is enough, but for corporate posting you need Marketing Developer Platform status. Approval takes 4 to 6 weeks; without it, no post goes through. But once approved, you get a flexible tool: automatic posting, analytics, content management. As noted in the LinkedIn API Reference, scope w_organization_social requires separate approval.

How does OAuth2 authorization through LinkedIn work?

We implement a standard flow: redirect the user to /authorization, get the code, exchange it for a token. Here's a ready-made route in Laravel 11:

Route::get('/auth/linkedin/redirect', function () { return redirect('https://www.linkedin.com/oauth/v2/authorization?' . http_build_query([ 'response_type' => 'code', 'client_id' => config('services.linkedin.client_id'), 'redirect_uri' => route('auth.linkedin.callback'), 'scope' => 'openid profile email w_member_social', 'state' => Str::random(16), ])); }); Route::get('/auth/linkedin/callback', function (Request $request) { $tokenResp = Http::post('https://www.linkedin.com/oauth/v2/accessToken', [ 'grant_type' => 'authorization_code', 'code' => $request->code, 'redirect_uri' => route('auth.linkedin.callback'), 'client_id' => config('services.linkedin.client_id'), 'client_secret' => config('services.linkedin.client_secret'), ])->json(); $accessToken = $tokenResp['access_token']; // Get user profile $profile = Http::withToken($accessToken) ->get('https://api.linkedin.com/v2/userinfo') ->json(); // $profile contains: sub (ID), name, email, picture return redirect('/dashboard'); }); 

The main thing is to check the state for CSRF protection. We store it in the session. The access token is issued with a short lifespan (up to 60 days), so be sure to implement a refresh mechanism. OAuth2 is the protocol on which the integration is built. It is 50 times more secure than scraping: LinkedIn bans suspicious IPs within minutes.

What do you need for corporate posting?

Publishing on behalf of a company requires a separate endpoint /ugcPosts. Example in Python:

import requests def create_company_post(access_token: str, org_id: str, text: str) -> str: headers = { 'Authorization': f'Bearer {access_token}', 'X-Restli-Protocol-Version': '2.0.0', } payload = { 'author': f'urn:li:organization:{org_id}', 'lifecycleState': 'PUBLISHED', 'specificContent': { 'com.linkedin.ugc.ShareContent': { 'shareCommentary': {'text': text}, 'shareMediaCategory': 'NONE', } }, 'visibility': {'com.linkedin.ugc.MemberNetworkVisibility': 'PUBLIC'}, } resp = requests.post('https://api.linkedin.com/v2/ugcPosts', headers=headers, json=payload) return resp.json()['id'] 

Important: the access_token must have scope w_organization_social, and the app must be approved. Without approval, the request returns a 403 error. B2B authorization through LinkedIn is especially in demand in corporate portals.

Comparison of integration methods

OAuth2 is the only legitimate path. Web scraping is 10 times less reliable: LinkedIn quickly bans IPs.

Typical LinkedIn API integration mistakes

• Incorrect redirect URI — must exactly match what is set in app settings.
• Missing scope — without openid you cannot get sub (unique user ID).
• Lack of approval for corporate posting — requests to /ugcPosts fail with 401.
• Expired tokens — LinkedIn issues tokens with a short lifespan (up to 60 days). Need a refresh token.

LinkedIn API integration checklist:

• [ ] App registered in LinkedIn Developer Portal
• [ ] Correct redirect URIs set
• [ ] State parameter generation and verification implemented
• [ ] Refresh token storage configured (if applicable)
• [ ] Marketing Developer Platform approval obtained (if corporate posting needed)
• [ ] OAuth flow tested in LinkedIn sandbox
• [ ] Token expiration monitoring set up

Integration implementation process

1. Requirements audit — determine what is needed: authorization, posting, or profile retrieval.
2. App registration in LinkedIn Developer Portal, get client ID and secret.
3. Request approval (if corporate access needed) — submit application to Partner Program.
4. Development: OAuth flow, token storage, API endpoints.
5. Testing in LinkedIn sandbox (if available).
6. Deployment and monitoring — check token renewal.

What is included in the integration work

• Requirements audit: identifying necessary scopes and use cases.
• App registration: preparing and submitting documents to LinkedIn Developer Portal.
• OAuth module development: implementing flow with best practices (state, refresh tokens).
• Corporate posting integration (optional): developing posting functionality, setting up approval.
• Documentation: description of API endpoints and instructions for token renewal.
• Support: warranty maintenance for 30 days after deployment.

Timelines and cost

Basic OAuth2 integration takes 2–3 business days. Corporate posting takes 4 to 8 weeks due to LinkedIn approval waiting. Cost is calculated individually, depends on complexity and need to prepare documents for the partner program. Posting automation saves up to 60% of time on manual entry. Start with a consultation — we will assess your scenario and offer the optimal solution. Get a ready-made module with documentation and a guarantee of performance — our experience in LinkedIn API integrations includes more than 20 projects for B2B companies. Order LinkedIn API implementation today. Contact us for a consultation.