Sign In with LinkedIn using OpenID Connect

https://learn.microsoft.com/en-us/linkedin/consumer/integrations/self-serve/sign-in-with-linkedin-v2
Admin
Enables applications to authenticate members and retrieve basic profile information using OpenID...
Tokens:5,246
Snippets:28
Trust Score:10
Update:11 months ago
Show doc for...
Tokens:
Raw
### Retrieve OpenID Connect Discovery Document (JSON)

Source: https://learn.microsoft.com/en-us/linkedin/consumer/integrations/self-serve/sign-in-with-linkedin-v2/index

Provides the OpenID Connect document containing OAuth endpoints, public keys, and supported claims. Used for validating ID tokens and configuring the integration. No external dependencies beyond an HTTP GET request.

```JSON
{
    "issuer": "https://www.linkedin.com",
    "authorization_endpoint": "https://www.linkedin.com/oauth/v2/authorization",
    "token_endpoint": "https://www.linkedin.com/oauth/v2/accessToken",
    "userinfo_endpoint": "https://api.linkedin.com/v2/userinfo",
    "jwks_uri": "https://www.linkedin.com/oauth/openid/jwks",
    "response_types_supported": [
        "code"
    ],
    "subject_types_supported": [
        "pairwise"
    ],
    "id_token_signing_alg_values_supported": [
        "RS256"
    ],
    "scopes_supported": [
        "openid",
        "profile",
        "email"
    ],
    "claims_supported": [
        "iss",
        "aud",
        "iat",
        "exp",
        "sub",
        "name",
        "given_name",
        "family_name",
        "picture",
        "email",
        "email_verified",
        "locale"
    ]
}
```

--------------------------------

### GET /v2/userinfo

Source: https://learn.microsoft.com/en-us/linkedin/consumer/integrations/self-serve/sign-in-with-linkedin-v2/index

Retrieves member profile details using the access token. This endpoint provides claims like name, email, and profile picture, supplementing the ID token for authenticated user information.

```APIDOC
## GET /v2/userinfo

### Description
Fetches authenticated member's profile information using the access token obtained from OIDC flow.

### Method
GET

### Endpoint
https://api.linkedin.com/v2/userinfo

### Parameters
#### Headers
- **Authorization** (string) - Required - Bearer {access_token}.

### Request Example
```
GET https://api.linkedin.com/v2/userinfo
Authorization: Bearer ACCESS_TOKEN
```

### Response
#### Success Response (200)
- **sub** (string) - Unique user identifier.
- **name** (string) - Full name.
- **given_name** (string) - First name.
- **family_name** (string) - Last name.
- **picture** (string) - Profile picture URL.
- **email** (string) - Email address (if scope requested).
- **email_verified** (boolean) - Email verification status.
- **locale** (string) - User locale.

#### Response Example
```
{
  "sub": "USER_ID",
  "name": "John Doe",
  "given_name": "John",
  "family_name": "Doe",
  "picture": "https://profile-image",
  "email": "john@example.com",
  "email_verified": true,
  "locale": "en_US"
}
```
```

--------------------------------

### Call UserInfo Endpoint to Retrieve Member Details (HTTP)

Source: https://learn.microsoft.com/en-us/linkedin/consumer/integrations/self-serve/sign-in-with-linkedin-v2/index

Makes an HTTP GET request to the LinkedIn UserInfo endpoint using the access token to obtain member profile information. Requires a valid bearer token obtained from the OAuth flow.

```HTTP
GET https://api.linkedin.com/v2/userinfo
Authorization: Bearer <access token>
```

--------------------------------

### GET /v2/userinfo

Source: https://learn.microsoft.com/en-us/linkedin/consumer/integrations/self-serve/sign-in-with-linkedin-v2/index_context=linkedin%2Fconsumer%2Fcontext

Retrieve member details by making a GET request to the userinfo endpoint. This endpoint requires an access token in the Authorization header and returns the authenticated member's profile information.

```APIDOC
## GET /v2/userinfo

### Description

In addition to the JWT received, you can also call the userinfo endpoint to retrieve the member details.

### Method

`GET`

### Endpoint

`https://api.linkedin.com/v2/userinfo`

### Parameters

#### Header Parameters

- **Authorization** (string) - Required - Bearer token for authentication. Example: `Bearer <access token>`

### Response

#### Success Response (200)

Returns a JSON object containing the authenticated member's profile information.

- **sub** (string) - User identifier.
- **name** (string) - Member's full name.
- **given_name** (string) - Member's given name.
- **family_name** (string) - Member's family name.
- **picture** (string) - URL to the member's profile picture.
- **email** (string) - Member's email address.
- **email_verified** (boolean) - Indicates if the member's email address has been verified.
- **locale** (string) - The member's locale (e.g., `en_US`).

#### Response Example (200)

```json
{
  "sub": "aBcDeFgHiJkLmNoPqRsT",
  "name": "Jane Doe",
  "given_name": "Jane",
  "family_name": "Doe",
  "picture": "https://example.com/picture.jpg",
  "email": "jane.doe@example.com",
  "email_verified": true,
  "locale": "en_US"
}
```
```

--------------------------------

### GET /oauth/v2/authorization

Source: https://learn.microsoft.com/en-us/linkedin/consumer/integrations/self-serve/sign-in-with-linkedin-v2/index

This endpoint initiates the OAuth 2.0 authorization code flow to authenticate members and obtain an authorization code. Include the 'openid' scope along with optional 'profile' and 'email' scopes to enable OIDC features. After user consent, redirect to the specified URI with the code.

```APIDOC
## GET /oauth/v2/authorization

### Description
Initiates the authorization code flow for member authentication using OpenID Connect.

### Method
GET

### Endpoint
https://www.linkedin.com/oauth/v2/authorization

### Parameters
#### Query Parameters
- **response_type** (string) - Required - Must be 'code' for authorization code flow.
- **client_id** (string) - Required - Your application's client ID.
- **redirect_uri** (string) - Required - URI to redirect after authorization.
- **scope** (string) - Required - Space-separated scopes: 'openid' (required for OIDC), 'profile' (for lite profile), 'email' (for email address).
- **state** (string) - Optional - CSRF protection parameter.

### Request Example
```
https://www.linkedin.com/oauth/v2/authorization?response_type=code&client_id=YOUR_CLIENT_ID&redirect_uri=https://yourapp.com/callback&scope=openid%20profile%20email&state=STATE_VALUE
```

### Response
#### Success Response (302)
Redirects to redirect_uri with 'code' and 'state' query parameters.

#### Response Example
```
https://yourapp.com/callback?code=AUTHORIZATION_CODE&state=STATE_VALUE
```
```

--------------------------------

### GET /v2/people/~

Source: https://learn.microsoft.com/en-us/linkedin/consumer/integrations/self-serve/sign-in-with-linkedin-v2/index_context=linkedin%2Fconsumer%2Fcontext

This endpoint retrieves the authenticated member's basic profile information after successful sign-in with LinkedIn. It returns details such as name, email, and profile picture, which can be used to personalize the user experience. Note that email-related fields are optional and may not be present in all responses.

```APIDOC
## GET /v2/people/~

### Description
Retrieves the authenticated member's basic profile information, including name, email, and profile picture. This is typically called after OAuth authentication to complete the sign-in process.

### Method
GET

### Endpoint
https://api.linkedin.com/v2/people/~

### Parameters
#### Path Parameters
None

#### Query Parameters
- **projection** (string) - Optional - Specifies fields to return (e.g., '(id,firstName,lastName)').

#### Request Body
None

### Request Example
No request body required. Ensure valid Bearer token in Authorization header.

### Response
#### Success Response (200)
- **sub** (string) - Subject Identifier
- **name** (string) - Full name
- **given_name** (string) - Member's first name
- **family_name** (string) - Member's last name
- **picture** (string) - Member's profile picture URL
- **locale** (string) - Member's locale
- **email** (string) - Optional - Member's primary e-mail address
- **email_verified** (boolean) - Optional - Indicator that Member's primary email has been verified

#### Response Example
```json
{
    "sub": "782bbtaQ",
    "name": "John Doe",
    "given_name": "John",
    "family_name": "Doe",
    "picture": "https://media.licdn-ei.com/dms/image/C5F03AQHqK8v7tB1HCQ/profile-displayphoto-shrink_100_100/0/",
    "locale": "en-US",
    "email": "doe@email.com",
    "email_verified": true
}
```

#### Error Responses
- 401 Unauthorized - Invalid or missing access token
- 403 Forbidden - Insufficient permissions
- 429 Too Many Requests - Rate limit exceeded (Member: 500/day, Application: 100,000/day)
```

--------------------------------

### Rate Limits

Source: https://learn.microsoft.com/en-us/linkedin/consumer/integrations/self-serve/sign-in-with-linkedin-v2/index

Information on the daily request limits for the Sign In with LinkedIn integration.

```APIDOC
## Rate Limits

### Description
These are the daily request limits imposed on the Sign In with LinkedIn integration, categorized by throttle type.

### Method
N/A

### Endpoint
N/A

### Parameters
None

### Request Example
None

### Response
#### Success Response (200)
- **Throttle Type** (Text) - The category of the rate limit (e.g., Member, Application).
- **Daily Request Limit (UTC)** (Integer) - The maximum number of requests allowed per day in UTC.

#### Response Example
```
Throttle Type | Daily Request Limit (UTC)
---|---
Member | 500
Application | 100,000
```
```

--------------------------------

### Fetch Member Details with OpenID Connect HTTP (HTTP)

Source: https://learn.microsoft.com/en-us/linkedin/consumer/integrations/self-serve/sign-in-with-linkedin-v2/index_context=linkedin%2Fconsumer%2Fcontext

Shows how to call the userinfo endpoint to retrieve the authenticated member's profile using an access token. Dependencies: HTTP client. Input: access token; Output: member profile payload. Limitations: Ensure proper scopes and tokens management.

```http
GET https://api.linkedin.com/v2/userinfo\nAuthorization: Bearer <access token>
```

--------------------------------

### User Profile Response Schema

Source: https://learn.microsoft.com/en-us/linkedin/consumer/integrations/self-serve/sign-in-with-linkedin-v2/index

This section details the structure of the response body when retrieving a member's profile information after a successful Sign In with LinkedIn.

```APIDOC
## GET /userinfo (Conceptual Endpoint)

### Description
This endpoint, conceptually represented, returns the authenticated member's profile information upon successful Sign In with LinkedIn.

### Method
GET

### Endpoint
/userinfo (Conceptual)

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Request Body
None

### Request Example
None

### Response
#### Success Response (200)
- **sub** (Text) - Subject Identifier
- **name** (Text) - Full name
- **given_name** (Text) - Member's first name
- **family_name** (Text) - Member's last name
- **picture** (Text) - Member's profile picture URL
- **locale** (Text) - Member's locale
- **email** (Text) - Optional: Member's primary e-mail address.
- **email_verified** (Boolean) - Optional: Indicator that Member's primary email has been verified.

**Note**: The 'email' and 'email_verified' fields are optional and may not be included in all responses. Ensure your application can handle cases where these fields are absent.

#### Response Example
```json
{
    "sub": "782bbtaQ",
    "name": "John Doe",
    "given_name": "John",
    "family_name": "Doe",
    "picture": "https://media.licdn-ei.com/dms/image/C5F03AQHqK8v7tB1HCQ/profile-displayphoto-shrink_100_100/0/",
    "locale": "en-US",
    "email": "doe@email.com",
    "email_verified": true
}
```
```

--------------------------------

### Parse LinkedIn API Response JSON

Source: https://learn.microsoft.com/en-us/linkedin/consumer/integrations/self-serve/sign-in-with-linkedin-v2/index

Sample JSON response from LinkedIn's Sign In API containing user profile data. Includes optional fields like email which may not be present in all responses. Applications should handle missing fields gracefully.

```json
{
    "sub": "782bbtaQ",
    "name": "John Doe",
    "given_name": "John",
    "family_name": "Doe",
    "picture": "https://media.licdn-ei.com/dms/image/C5F03AQHqK8v7tB1HCQ/profile-displayphoto-shrink_100_100/0/",
    "locale": "en-US",
    "email": "doe@email.com",
    "email_verified": true
}
```

--------------------------------

### Sign in with LinkedIn API - Discovery Document

Source: https://learn.microsoft.com/en-us/linkedin/consumer/integrations/self-serve/sign-in-with-linkedin-v2/index_context=linkedin%2Fconsumer%2Fcontext

The OIDC discovery document provides metadata about the LinkedIn OpenID Connect provider, including endpoints for authorization, token exchange, user info, and public keys for token validation.

```APIDOC
## OIDC Discovery Document

ID Tokens can be validated using the metadata provided by discovery document which contains OAuth endpoints, public keys and claims.

### Endpoint

`/.well-known/openid-configuration` (or similar, check LinkedIn's specific documentation for the exact path)

### Response Body Example

```json
{
  "issuer": "https://www.linkedin.com",
  "authorization_endpoint": "https://www.linkedin.com/oauth/v2/authorization",
  "token_endpoint": "https://www.linkedin.com/oauth/v2/accessToken",
  "userinfo_endpoint": "https://api.linkedin.com/v2/userinfo",
  "jwks_uri": "https://www.linkedin.com/oauth/openid/jwks",
  "response_types_supported": [
    "code"
  ],
  "subject_types_supported": [
    "pairwise"
  ],
  "id_token_signing_alg_values_supported": [
    "RS256"
  ],
  "scopes_supported": [
    "openid",
    "profile",
    "email"
  ],
  "claims_supported": [
    "iss",
    "aud",
    "iat",
    "exp",
    "sub",
    "name",
    "given_name",
    "family_name",
    "picture",
    "email",
    "email_verified",
    "locale"
  ]
}
```

JWKS_URI provided in the discovery document can be used for signature verification.
```

--------------------------------

### Validate ID Tokens with OpenID Connect (JSON)

Source: https://learn.microsoft.com/en-us/linkedin/consumer/integrations/self-serve/sign-in-with-linkedin-v2/index_context=linkedin%2Fconsumer%2Fcontext

Demonstrates the OpenID Connect discovery document fields used to validate an ID Token. Dependencies include the OpenID Connect/OAuth 2.0 concepts and the LinkedIn discovery metadata. Inputs are the ID Token and discovery data; outputs include endpoint URLs and supported claims. Limitations: ID Tokens must be validated against signatures using JWKS and are not proof of user identity by themselves.

```json
{\n    \"issuer\": \"https://www.linkedin.com\",\n    \"authorization_endpoint\": \"https://www.linkedin.com/oauth/v2/authorization\",\n    \"token_endpoint\": \"https://www.linkedin.com/oauth/v2/accessToken\",\n    \"userinfo_endpoint\": \"https://api.linkedin.com/v2/userinfo\",\n    \"jwks_uri\": \"https://www.linkedin.com/oauth/openid/jwks\",\n    \"response_types_supported\": [\n        \"code\"\n    ],\n    \"subject_types_supported\": [\n        \"pairwise\"\n    ],\n    \"id_token_signing_alg_values_supported\": [\n        \"RS256\"\n    ],\n    \"scopes_supported\": [\n        \"openid\",\n        \"profile\",\n        \"email\"\n    ],\n    \"claims_supported\": [\n        \"iss\",\n        \"aud\",\n        \"iat\",\n        \"exp\",\n        \"sub\",\n        \"name\",\n        \"given_name\",\n        \"family_name\",\n        \"picture\",\n        \"email\",\n        \"email_verified\",\n        \"locale\"\n    ]\n}
```

--------------------------------

### Sign in with LinkedIn API - Authentication Scopes

Source: https://learn.microsoft.com/en-us/linkedin/consumer/integrations/self-serve/sign-in-with-linkedin-v2/index_context=linkedin%2Fconsumer%2Fcontext

When requesting an authorization code for Sign in with LinkedIn using OpenID Connect, specify the 'openid' scope along with 'profile' and 'email' to enable OIDC authentication and retrieve user information.

```APIDOC
## Authenticating Members

New members logging in to your service for the first time will need to follow the Authenticating with OAuth 2.0 Guide. When requesting the authorization code in Step 2 of the OAuth 2.0 Guide, make sure you use the OpenID scope `openid` to get the ID Token. We are also introducing new scopes `profile` and `email`.

### Parameters

#### Query Parameters

- **scope** (string) - Required - A space-separated list of scopes. Use `openid` for OIDC, and optionally `profile` and `email` to retrieve user profile and email information.

### Example Scopes

- `openid`
- `openid profile`
- `openid profile email`
```

--------------------------------

### POST /oauth/v2/accessToken

Source: https://learn.microsoft.com/en-us/linkedin/consumer/integrations/self-serve/sign-in-with-linkedin-v2/index

Exchanges the authorization code for an access token and ID token. This endpoint is part of the OAuth 2.0 token request, providing the ID token for OIDC authentication which contains member claims.

```APIDOC
## POST /oauth/v2/accessToken

### Description
Exchanges authorization code for access token and ID token to authenticate the member via OIDC.

### Method
POST

### Endpoint
https://www.linkedin.com/oauth/v2/accessToken

### Parameters
#### Request Body
Content-Type: application/x-www-form-urlencoded
- **grant_type** (string) - Required - Must be 'authorization_code'.
- **code** (string) - Required - Authorization code from previous step.
- **redirect_uri** (string) - Required - Must match the one used in authorization request.
- **client_id** (string) - Required - Your application's client ID.
- **client_secret** (string) - Required - Your application's client secret.

### Request Example
```
POST https://www.linkedin.com/oauth/v2/accessToken
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&code=AUTH_CODE&redirect_uri=https://yourapp.com/callback&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET
```

### Response
#### Success Response (200)
- **access_token** (string) - Access token for API calls.
- **id_token** (string) - JWT containing member claims for OIDC.
- **expires_in** (integer) - Token expiration time in seconds.

#### Response Example
```
{
  "access_token": "ACCESS_TOKEN",
  "id_token": "ID_TOKEN_JWT",
  "expires_in": 5184000
}
```
```

--------------------------------

### Sign in with LinkedIn API - ID Token Payload Claims

Source: https://learn.microsoft.com/en-us/linkedin/consumer/integrations/self-serve/sign-in-with-linkedin-v2/index_context=linkedin%2Fconsumer%2Fcontext

The ID Token received after successful authentication is a JSON Web Token (JWT) containing claims about the member and the authentication process. These claims include issuer, subject, audience, issue time, expiration time, and various user profile details.

```APIDOC
## ID Token Payload Claims

The ID Token is a security token that contains Claims about the Authentication of a member by an Authorization Server when using a Client, and potentially other requested Claims. The ID Token is represented as a JSON Web Token (JWT). With OIDC, you are now able to extract the member details from the ID Token.

### Claims

- **iss** (string) - The authorization server’s Identifier of the response (e.g., `https://www.linkedin.com`).
- **sub** (string) - User identifier.
- **aud** (string) - client_id of Relying party/caller Application guarantees user authentication for itself.
- **iat** (integer) - ID Token issue time (Unix timestamp).
- **exp** (integer) - Expiration time of the token (Unix timestamp). The relying party processing this token should reject it once the expiration time is reached.
- **name** (string) - Member's full name.
- **given_name** (string) - Member's given name.
- **family_name** (string) - Member's family name.
- **picture** (string) - URL to the member's profile picture.
- **email** (string) - Member's email address.
- **email_verified** (boolean) - Indicates if the member's email address has been verified.
- **locale** (string) - The member's locale (e.g., `en_US`).
```
Tokens:
Raw