LinkedIn API Permissions
The LinkedIn API permissions/scopes needed to post content on a member’s behalf.
By André LugFor the common case, posting on a LinkedIn member’s behalf needs exactly one scope: w_member_social, from the self-serve “Share on LinkedIn” product — no manual review required. Pair it with openid and profile for identity. The Company Page scopes (w_organization_social and friends) sit behind LinkedIn’s Community Management API partner program, with its own application and manual review.
LinkedIn calls its OAuth permissions "scopes," and it groups them by product: adding a product to an app is what makes its scopes requestable in the consent flow. Posting on a member's behalf needs exactly one of those products for the common case — here's which scope does what, and where the line to a much heavier access tier sits.
w_member_social: the one that lets you post
w_member_social lets an app post, comment, and like on behalf of the authenticated member. It comes from LinkedIn's self-serve "Share on LinkedIn" product — add the product in your app's Products tab and the scope becomes requestable, no manual review required. This is the scope PostGate requests when a member connects a LinkedIn profile.
GET https://www.linkedin.com/oauth/v2/authorization
?client_id=...
&redirect_uri=...
&response_type=code
&state=...
&scope=openid%20profile%20w_member_socialDo openid and profile grant publishing?
openid and profile come from LinkedIn's "Sign In with LinkedIn using OpenID Connect" product and return the member's ID, name, and avatar via /v2/userinfo. They don't grant any write access on their own — pair them with w_member_social to both identify the member and be allowed to post as them.
Are the organization scopes a different tier?
w_organization_social (post as a Company Page), r_organization_social (read a Page's posts), and rw_organization_admin (Page administration) all require LinkedIn's Community Management API — a partner program with its own application, screencast, and manual review — plus the connecting member holding an admin-level role on that specific Page. None of these are covered by the self-serve product above. See LinkedIn Community Management API Access and LinkedIn Company Page Post API.
What is the token you get back worth?
A standard member access token from this scope set is typically valid for around 60 days and, on the standard tier, doesn't come with a refresh token — the member reconnects through the consent screen again when it lapses. PostGate tracks this and marks a profile awaiting_reconnect ahead of the expiry rather than letting a scheduled post fail against a dead token; see profile health.
Frequently asked questions
What LinkedIn scope do I need to post on a member’s behalf?
w_member_social — it lets an app post, comment, and like on behalf of the authenticated member. It comes from LinkedIn’s self-serve “Share on LinkedIn” product: add the product in your app’s Products tab and the scope becomes requestable, with no manual review required. It is the scope PostGate requests when a member connects a LinkedIn profile.
Do the openid and profile scopes let me post to LinkedIn?
No — they come from LinkedIn’s “Sign In with LinkedIn using OpenID Connect” product and return the member’s ID, name, and avatar via /v2/userinfo. They don’t grant any write access on their own; pair them with w_member_social to both identify the member and be allowed to post as them.
What permissions does posting to a LinkedIn Company Page require?
w_organization_social (post as a Company Page), r_organization_social (read a Page’s posts), and rw_organization_admin (Page administration) all require LinkedIn’s Community Management API — a partner program with its own application, screencast, and manual review — plus the connecting member holding an admin-level role on that specific Page. None of these are covered by the self-serve product.
How long does a LinkedIn member access token last?
A standard member access token from this scope set is typically valid for around 60 days and, on the standard tier, doesn’t come with a refresh token — the member reconnects through the consent screen again when it lapses. PostGate tracks this and marks a profile awaiting_reconnect ahead of the expiry rather than letting a scheduled post fail against a dead token.
