Linkedin Ads Authentication

generated: '2026-08-13'
method: searched
source: openapi/_original/linkedin-ads-openapi.yml
docs: https://learn.microsoft.com/en-us/linkedin/shared/authentication/authorization-code-flow
note: >-
  Derived from the repository OpenAPI, then upgraded from LinkedIn's own auth
  documentation and a live fetch of the OpenID Connect discovery document at
  https://www.linkedin.com/oauth/.well-known/openid-configuration (HTTP 200).
summary:
  types:
    - oauth2
    - openIdConnect
  oauth2_flows:
    - authorizationCode
    - clientCredentials
schemes:
  - name: OAuth2
    type: oauth2
    flows:
      - flow: authorizationCode
        authorizationUrl: https://www.linkedin.com/oauth/v2/authorization
        tokenUrl: https://www.linkedin.com/oauth/v2/accessToken
        scopes: 4
    description: >-
      OAuth 2.0 three-legged (authorization code) flow — the flow every Marketing
      API call uses. The member consents to the full requested scope set; scopes
      cannot be selected individually, and changing an app's scopes forces
      members to re-authenticate.
    sources:
      - openapi/linkedin-ads-openapi.yml
  - name: OpenIDConnect
    type: openIdConnect
    openIdConnectUrl: https://www.linkedin.com/oauth/.well-known/openid-configuration
    issuer: https://www.linkedin.com/oauth
    jwks_uri: https://www.linkedin.com/oauth/openid/jwks
    userinfo_endpoint: https://api.linkedin.com/v2/userinfo
    id_token_signing_alg_values_supported: [RS256]
    scopes: [openid, profile, email]
    description: >-
      Sign In with LinkedIn using OpenID Connect. Discovery document served live
      and captured verbatim in well-known/linkedin-ads-openid-configuration.json.
    sources:
      - well-known/linkedin-ads-openid-configuration.json
  - name: OAuth2ClientCredentials
    type: oauth2
    flows:
      - flow: clientCredentials
        tokenUrl: https://www.linkedin.com/oauth/v2/accessToken
    description: >-
      Two-legged flow, available only to selected partner programs; it grants
      application-level access with no member context and is not used by the
      advertising surface.
    sources:
      - https://learn.microsoft.com/en-us/linkedin/shared/authentication/client-credentials-flow
transport:
  header: 'Authorization: Bearer {access_token}'
  bearer_format: opaque (approximately 500 characters; plan for 1000)
tokens:
  access_token_ttl_seconds: 5184000
  access_token_ttl_human: 60 days
  refresh_token: true
  refresh_token_note: >-
    Refresh tokens are longer-lived than access tokens and are returned with
    refresh_token_expires_in; programmatic refresh is documented.
  introspection: true
  introspection_docs: https://learn.microsoft.com/en-us/linkedin/shared/authentication/token-introspection
  revocation: >-
    Members can revoke an application's access from their LinkedIn privacy
    settings; subsequent calls fail 401 and the member must re-authenticate.
app_registration:
  portal: https://www.linkedin.com/developers/apps
  create: https://www.linkedin.com/developers/apps/new
  credentials: Client ID + Client Secret, per app
  redirect_uri_rules:
    - must be absolute HTTPS
    - query parameters are ignored
    - fragments (#) are invalid
  token_generator: https://www.linkedin.com/developers/tools/oauth
  postman: >-
    https://www.postman.com/linkedin-developer-apis/workspace/linkedin-marketing-solutions-versioned-apis/overview
scopes_artifact: scopes/linkedin-ads-scopes.yml
x-evidence:
  fetched: '2026-08-13'
  checks:
    - url: https://learn.microsoft.com/en-us/linkedin/shared/authentication/authorization-code-flow
      http_status: 200
    - url: https://www.linkedin.com/oauth/.well-known/openid-configuration
      http_status: 200
    - url: https://learn.microsoft.com/en-us/linkedin/shared/authentication/token-introspection
      http_status: 200