How to Get a LinkedIn API Key in 2026 (And What It Actually Unlocks)

You can have LinkedIn API credentials in about ten minutes. No application, no review, no waiting.

That is the good news, and it is where most guides stop. Here is the part they leave out: those credentials let you read the name, headline, profile photo, and email address of people who click a "Sign in with LinkedIn" button on your own application. That is the entire dataset. If you came here to look up a profile by URL, search for people by job title, pull company data, or enrich a list of leads, the free self-serve key does none of that — and the programs that do are behind approval gates that take months and reject most applicants.

We build a professional data API, so we spend a lot of time talking to developers who arrive at this exact wall. This guide covers both halves properly. First, how to get official LinkedIn API credentials and precisely what they return. Then what LinkedIn API access costs at each tier. Then which endpoints exist and which do not. And finally, what to do when the official route does not cover your use case.

Short on time? Jump to what the free tier returns, what the LinkedIn API costs, or profile lookup and search without OAuth.

Does LinkedIn have a public API?

LinkedIn has an API. It does not have a public one in the sense most developers mean.

There is no open endpoint you can hit with a key to fetch an arbitrary profile. There is no public search. LinkedIn's REST API is a set of product-specific interfaces, each tied to a partner program, each requiring your application to act on behalf of an authenticated member or an approved commercial integration.

LinkedIn's own documentation (Getting Access to LinkedIn APIs) states the position plainly: most permissions and partner programs require explicit approval, and Open Permissions are the only ones available to all developers without special approval.

So when people ask whether LinkedIn has a public API, the accurate answer is: it has a free tier that is public, and that tier is narrow enough that most people who find it conclude it does not count.

There is no "LinkedIn API key" — there are three different things

A lot of the confusion here is vocabulary. People search for an API key because that is how most APIs work: sign up, copy a string, put it in a header, done. LinkedIn does not work that way, and its own documentation uses shifting terminology depending on which page you land on.

When you register an application in the LinkedIn Developer Portal you receive two values. LinkedIn describes the Client ID as the "Consumer key/API key" and pairs it with a Client Secret. So the thing people call a LinkedIn API key is really the Client ID — and on its own it authenticates nothing.

You never send the Client ID to an API endpoint. You send an access token, and you get that token by walking a specific LinkedIn member through a consent screen. Every call you make is made on behalf of that member, scoped to what they personally agreed to share.

That single design decision explains almost everything else about the platform. LinkedIn's API is built for applications acting on behalf of their own signed-in users. It is not built for querying the network.

Getting your LinkedIn API credentials: the ten-minute version

Nothing in this section requires approval.

1. Create a LinkedIn Page for your company. This trips up more people than any other step. Application registration requires an associated Page and you must be a verified admin of it. If your company does not have one, create it first — a bare-bones Page is enough to unblock registration.

2. Register the application. Go to the LinkedIn Developer Portal and create a new app. You supply an app name, the associated Page, a privacy policy URL, and a logo. The privacy policy URL gets checked, so point it at a real page.

3. Verify the Page association. LinkedIn generates a verification link. Open it as a Page admin and confirm. Instant if you have the right permissions, impossible if you do not.

4. Read your credentials from the Auth tab. Select your app and open Auth. Client ID and Client Secret are both there. LinkedIn's guidance is explicit that the Client Secret should never be shared, never passed in a URL, and never posted in support forums or chat.

5. Add a redirect URL. Same tab. The rules are strict and worth reading before you lose an afternoon to a 401:

• URLs must be absolute — https://dev.example.com/auth/linkedin/callback, not a relative path
• Query parameters are ignored — anything after ? is stripped
• URLs cannot contain a # fragment
• HTTPS only

If you are testing in Postman, LinkedIn suggests https://oauth.pstmn.io/v1/callback as your redirect URL with browser-based authorization enabled.

6. Enable products under the Products tab. This is where scopes come from. Self-serve products can be added immediately; everything else shows an application form.

7. Generate a test token. The Developer Portal ships a token generator that walks the OAuth flow for you, so you can make a real API call before writing any integration code. Use it to sanity-check your setup.

You now have working credentials. Which brings us to the part that matters.

What the free self-serve tier actually returns

Per LinkedIn's permissions reference, Open Permissions are the only permissions available to all developers without special approval, and they can be added self-service through the Developer Portal under the Products tab. There are three:

Read that table twice, because it is the honest answer to "is the LinkedIn API free?" Yes — and it returns four fields about people who have personally authorized your specific application.

No work history. No education. No skills. No company data. No people search. No profile lookup by URL or username. No connections. No follower counts. No third-party profiles of any kind. No analytics.

If you are building social login, or a scheduling tool that publishes to a user's own feed, this tier is genuinely all you need and it costs nothing. Use it. If you are building anything that touches data about people who are not your users, it is the wrong door and no amount of configuration will change that.

What sits behind the gates

Every other capability belongs to a partner program with its own application, eligibility bar, and timeline.

That last row deserves attention. r_compliance and w_compliance still appear in LinkedIn's documentation, so you will find blog posts and Stack Overflow answers referencing them. They are documented history. You cannot apply.

On Sales: reporting in 2026 indicates the Sales Navigator API is not accepting new partner applications, with existing partners retaining access while everyone else is locked out indefinitely. If your architecture depends on SNAP, verify that before you build anything around it.

What does the LinkedIn API cost?

This is one of the most searched questions in the category and it has an unsatisfying answer: LinkedIn does not publish pricing for anything above the free tier.

Here is what can actually be said:

Treat every specific number you see written about LinkedIn API pricing — including the one above — as unverified. There is no price list. There is an application, a conversation, and a contract.

Approval timelines are equally unofficial. LinkedIn does not publish target timelines, and reported developer experience through 2025 and 2026 places a four-to-eight-week turnaround in the exception category rather than the norm.

So "how much does the LinkedIn API cost" splits into two real answers. Free, if you only need data about your own authenticated users. Unknown and gated, for everything else.

LinkedIn API endpoints: what exists, and what people are actually looking for

When developers search for LinkedIn API endpoints, they usually have a specific job in mind. Here is the honest mapping between what people want and what the official platform offers.

Rows four onward are where most people searching for a LinkedIn data API actually live. If that is you, the Developer Portal is a detour and this is worth knowing before you spend a week on OAuth.

Making your first authenticated call

Assuming you enabled Sign in with LinkedIn using OpenID Connect, here is the whole flow.

Step 1: Send the member to the authorization page

1GET https://www.linkedin.com/oauth/v2/authorization
2  ?response_type=code
3  &client_id=YOUR_CLIENT_ID
4  &redirect_uri=https://dev.example.com/auth/linkedin/callback
5  &state=a_random_unguessable_string
6  &scope=openid%20profile%20email

The state parameter is not optional in practice. LinkedIn's guidance is to verify the returned state matches what you sent and return a 401 if it does not, since a mismatch indicates a possible CSRF attack.

Worth knowing: if multiple scopes are requested the member must consent to all of them and cannot select individually, so requesting more than you need directly increases drop-off at the consent screen.

Step 2: Exchange the code for a token

The member comes back with code and state on the query string. The authorization code has a 30-minute lifespan and must be used promptly; once it expires you restart the flow.

1import os
2import requests
3
4resp = requests.post(
5    "https://www.linkedin.com/oauth/v2/accessToken",
6    data={
7        "grant_type": "authorization_code",
8        "code": auth_code,
9        "client_id": os.environ["LINKEDIN_CLIENT_ID"],
10        "client_secret": os.environ["LINKEDIN_CLIENT_SECRET"],
11        "redirect_uri": "https://dev.example.com/auth/linkedin/callback",
12    },
13    headers={"Content-Type": "application/x-www-form-urlencoded"},
14)
15
16token = resp.json()["access_token"]

1const params = new URLSearchParams({
2  grant_type: 'authorization_code',
3  code: authCode,
4  client_id: process.env.LINKEDIN_CLIENT_ID,
5  client_secret: process.env.LINKEDIN_CLIENT_SECRET,
6  redirect_uri: 'https://dev.example.com/auth/linkedin/callback',
7});
8
9const res = await fetch('https://www.linkedin.com/oauth/v2/accessToken', {
10  method: 'POST',
11  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
12  body: params,
13});
14
15const { access_token: token } = await res.json();

Step 3: Call the API

1curl -X GET 'https://api.linkedin.com/v2/userinfo' \
2  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Note this is Bearer — the standard OAuth pattern. Your Client ID never appears here.

Token lifetimes and the refresh problem

Access tokens are currently issued with a 60-day lifespan. That sounds generous until you read how refreshing works.

LinkedIn's documented refresh path is to send the member through the authorization flow again. The consent screen is bypassed and the redirect is silent — but only if the member is still logged in to linkedin.com and their current token has not yet expired. If either condition fails, they go through the full authorization process again.

In other words, the standard refresh is browser-dependent. A backend job that wakes up on day 61 to renew tokens cannot do it — there is no user session to piggyback on. Programmatic refresh tokens exist but are available only to a limited set of partners.

Design for this on day one. Refresh at day 45, not day 59, and treat the re-consent path as a normal product flow rather than an error state.

One more trap: if you request a different scope than previously granted, all existing access tokens are invalidated. Shipping a feature that adds a scope will silently log out your entire user base.

The errors you will actually hit

Redirect URI mismatch is by far the most common. LinkedIn compares the string it received against the registered value, and since query parameters are stripped, a callback that works fine in your framework may not match what you registered.

Profile lookup, search and enrichment without OAuth

If your use case is in the bottom half of the endpoint table above, you need a different category of tool: a professional data API. These solve the shape of the problem the official platform does not address — reading structured information about people and companies you have no authentication relationship with.

They also issue a real API key, in the ordinary sense. One string, one header, no OAuth dance, no partner application.

We built LinkdAPI as one of these. Here is the whole setup:

1. Sign up at linkdapi.com/signup. No card required. You get 100 free credits, and most endpoints cost 1 credit per call.

2. Copy your key from the dashboard.

3. Make a request.

1curl -s -H "X-linkdapi-apikey: $LINKDAPI_KEY" \
2  "https://linkdapi.com/api/v1/profile/overview?username=ryanroslansky"

The header is . Not , not — both return 401. This catches people migrating from other services, because muscle memory reaches for Bearer.