Agentic Fabriq
MESSAGING · MESSAGING
The connected member’s profile, and posts shared on their behalf.
Connecting LinkedIn in practice
LinkedIn does not publish its rate limits at all: they are per-application and per-member daily quotas that reset at midnight UTC, and the only way to read one is your app’s Analytics tab in the Developer Portal — which shows an endpoint only after you have already called it at least once that day. Access tokens last 60 days and programmatic refresh tokens are "available for a limited set of partners", so most integrations have to send the member back through consent instead.
Scopes that draw scrutiny
w_member_social"Post, comment, and like posts on your behalf" — the scope that lets an agent publish as the human, which is the one a security reviewer stops on.r_basicprofileName, photo, headline and public profile URL. Available only to apps approved for a Product that includes it, so it cannot simply be requested.r_1st_connections_sizeThe size of the member’s first-degree network — network data rather than profile data, and gated behind Advertising or Community Management API approval.r_organization_adminOrganisation pages plus follower, visitor and content analytics. It reaches company-level data through one person’s token, so it depends on that member’s Page role.rw_organization_adminManages organisation Pages, restricted to members holding the ADMINISTRATOR role on that organisation. A member without the role gets nothing even with the scope granted.
Rate limits
- Two ceilings per endpoint: Application (all calls your app makes in a day) and Member (all calls one member’s token makes in a day).
- Both reset at midnight UTC and both vary by endpoint. "Standard rate limits are not published in documentation."
- Over the limit returns 429; LinkedIn also returns 429 occasionally as infrastructure protection, and recovery is automatic.
- Developer Admins are emailed at 75% of the application quota, with a 1–2 hour delay, and only for application-level breaches — never member-level.
Who has to approve
Not a workspace admin, but a LinkedIn-side product gate: "The scopes available to your app depend on which Products or Partner Programs your app has access to", and you apply for Products in the Developer Portal. Until a Product is approved the scope simply cannot be requested, and an invalid scope is a 401 at the authorization step.
Worth knowing
- An authorization code has a 30-minute lifespan and must be used immediately, so a queued or retried exchange fails and the member has to start over.
- Requesting a different scope than was previously granted invalidates all of that member’s existing access tokens, so adding one permission logs out every other session you held.
- Changing an app’s scopes forces every existing user to re-authenticate — there is no incremental consent that upgrades installed grants.
- Social login and passkey sign-in work only on desktop and Android web unless you pass `enable_extended_login=true` on /oauth/v2/authorization.
Checked against LinkedIn API rate limiting (2026-09-29), 3-legged OAuth flow (2026-09-29), Increasing access (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put LinkedIn behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.