LinkedIn (Community Management API for Company Page posting)
Sign In with LinkedIn (OpenID Connect) and Share on LinkedIn (w_member_social, posting as a person) are self-serve and work within minutes. Posting as a Company Page needs w_organization_social, and that only comes with the vetted Community Management API. Access is limited to registered legal organizations with a business email, and the app must be verified by the super admin of your LinkedIn Page. You get a rate-limited Development tier first, then apply for Standard tier with a screencast. LinkedIn publishes no review time; plan on weeks, and a rejection means starting over with a new app.
Review: Community Management API Development tier access form (legal org, business email, Page-verified app, approved use case), then Standard tier access form with screencast, test credentials and privacy policy review
Timing: First token: 15 min for openid/profile/email + w_member_social (personal posts); Company Page posting has no first token until Development tier is approved. 4-10 weeks (Development tier vetting reported at 1-3+ weeks, then build, then Standard tier review with screencast); no official SLA.
Cost: free (no license or per-call fee)
Before you start
- for buildA LinkedIn Company Page for the developer's organization, with a super admin who approves the app association (30-day window; the association is permanent)sourcedl5l8l4
- for launchRegistered legal organization: legal name, registered address, website✗ missing in profilesourcedl4
- for launchVerified business email (personal addresses fail vetting)✓ Iskaria has itsourcedl4
- for launchPrivacy policy URL✓ Iskaria has itsourcedl4
- for launchWebsite and domain that match the organization✓ Iskaria has itsourcedl4
- for buildApp logo and name without any part of the LinkedIn/Microsoft names or logos✗ missing in profilesourcedl4
- for launchScreencast (high-resolution, downloadable, narration recommended) and test credentials, for Standard tier✗ missing in profilesourcedl4
- for buildHTTPS absolute redirect URL✓ Iskaria has itsourcedl7
Before approval only the open permissions work (openid, profile, email, w_member_social: posting as yourself, not as a Page). Development tier: 500 calls per app and 100 per member per 24 h, no BATCH_GET, social-action webhooks disabled. Integration must be finished within 12 months. Access tokens last 60 days; programmatic refresh tokens (365 days) come only with approved Marketing API (MDP) access such as Community Management, not with the self-serve products.
Who does what
- Draft the Development and Standard tier use-case text from the profile
- Check the request against LinkedIn's restricted-use-cases list before submission
- Implement the 3-legged OAuth flow, Posts API with organization author, and /organizationAcls Page listing
- Write the screencast script for the Page Management test cases
- Track 60-day token expiry and prompt re-consent; respect Development tier rate limits
- Create the Company Page and developer app with a real LinkedIn account
- Get a Page super admin to verify the app
- Supply the legal entity details and verify the business email
- Submit both access forms, record the screencast, provide reviewer test credentials
Steps
Create the Page under a real member account (no fake/headless profiles) and set its website to iskaria.com. Business verification on LinkedIn's side is checked against this Page and domain.
Website https://iskaria.com/ linkedin.com/developers/apps/new: name, the Iskaria Page, privacy policy URL, logo. Don't add Sign In with LinkedIn or other products to this app first. LinkedIn only lets you request Community Management on new apps that have no other API products. Use a separate app for login if you need one.
https://www.linkedin.com/developers/apps/newApp name Iskaria LinkedIn Page Permanent association; cannot be transferred Privacy policy URL https://iskaria.com/privacy App logo missing: logo.square512PngMissing in profile Settings tab > Verify. Send the verification request to a super admin of the Iskaria Page, who has 30 days to approve. Unverified apps fail Development tier vetting.
Auth tab: add the absolute HTTPS callback (no #, query ignored). Use the Token Generator or the 3-legged flow. Before approval only open scopes are listed.
Authorized redirect URLs for your app ["https://app.iskaria.com/api/oauth/{provider}/callback","http://localhost:3000/api/oauth/{provider}/callback"] Implement OAuth with w_organization_social + r_organization_social (+ rw_organization_admin to list Pages via /organizationAcls). Post with the Posts API using the organization URN as author. Stay under 500 calls/app/day, and finish within 12 months.
- 5Apply for Community Management API Development tierAgent drafts, you submit30 min hands-on; ~10-14 business days reportedsourcedl4l10
Products tab > Community Management API > access form. Give the legal name, registered address, website, privacy policy and business email (then verify the email), and describe the use case: a clinic's assistant posts to that clinic's own Page. Read the restricted use cases first. An agent can draft the use-case text; a human submits.
Organization legal name missing: legalEntityMissing in profile Business email ibrahim@iskaria.com Website https://iskaria.com/ Privacy policy https://iskaria.com/privacy Use case Let the clinic's AI assistant read and act on the clinic's own data in this app Page Management use case: show the full OAuth approval, a post going to the LinkedIn Page from the app, how a member's comment on it appears in the app, and which commenter profile fields are shown. Use high resolution and a downloadable file, show only your app's screens, and narrate.
- 8Apply for Standard tierAgent drafts, you submit1 h hands-on; weeks of waiting (no published SLA)sourcedl3l4
My Apps > Products > Standard tier access form: company and product overview, use case, test credentials, screencast. LinkedIn reviews against privacy policy, terms, security and data-storage rules, and may decline at its discretion. A rejection means a new app and a new Development tier application.
Screencast missing: demoVideoUrlMissing in profile Company overview Iskaria is a multi-clinic operations console with an AI assistant. Clinic staff connect their business accounts so the assistant can answer patient messages, track leads and report on marketing performance. Access tokens last 60 days, and programmatic refresh tokens (valid 365 days) are issued only to apps approved for the Marketing Developer Platform, which Community Management access is part of; self-serve apps (Sign In, Share on LinkedIn) get none. Without refresh tokens, re-run the authorization flow (silent if the member is still logged in) before expiry. If you change scopes, users must re-consent, and earlier tokens are invalidated.
Scopes an agent typically needs
| Scope | Used for | Review tier | Evidence |
|---|---|---|---|
| w_organization_social | Create posts, comments and reactions as the clinic's Company Page Only via the Community Management (or Advertising) API. The member must be an admin of that Page. | partner-only | sourcedl3 |
| r_organization_social | Read the Page's own posts and engagement to confirm publication and report results | partner-only | sourcedl3 |
| rw_organization_admin | List the Pages the member administers and read Page analytics Restricted to organizations where the member has the ADMINISTRATOR role. | partner-only | sourcedl3 |
| w_member_social | Post as the authenticated person (e.g. a doctor's own profile), not as the Page Open via the self-serve Share on LinkedIn product. Using it with an organization author returns HTTP 400 'Organization permissions must be used when using organization as author'. | basic | sourcedl1l6l11 |
| openid profile email | Identify the staff member who connects LinkedIn Sign In with LinkedIn using OpenID Connect, self-serve. Put it on a separate app from Community Management. | basic | sourcedl1l2 |
What can slow you down or block approval
Community Management is only for registered legal organizations with commercial use cases. LinkedIn checks the organization, website/domain and business email.
Workaround: Fill legalEntity, make the Page website iskaria.com, and use the iskaria.com email.
A rejected Development or Standard tier request can't be re-applied for on the same app. You must create a new app and start again with Development tier.
Workaround: Prepare every field and the screencast before submitting.
The access request is greyed out on apps that already have other API products (e.g. Sign In with LinkedIn), so login and Page posting end up as two apps.
Member data (commenters, reactors) may not be used to create leads or enrich a CRM, may not be combined with other data, may only be displayed in the app, and social activity data may be stored for 48 hours at most. An Iskaria assistant that turns LinkedIn commenters into clinic leads would be a restricted use case.
Workaround: Keep the LinkedIn use case to publishing and Page analytics. Don't feed member data into lead tracking.
LinkedIn may decline to upgrade even when the minimum requirements are met, and Development tier access lapses if the integration isn't completed within 12 months.
LinkedIn publishes no turnaround. A 2026 report describes 14+ business days at 'Access Form Review' with support cases routed to the wrong teams.
What we checked
| Claim | How | Result |
|---|---|---|
| Community Management Development tier is limited to 100 calls per app and 10 per member per day Raised to 500 per app and 100 per member per 24 h. BATCH_GET is disallowed and webhooks are off. | Fetched Community Management overview FAQ and Increasing Access table | corrected |
| Company Page posting is part of the 'Marketing Developer Platform' The docs now name separate vetted products (Advertising API, Community Management API) under the Marketing API program. Organic Page posting is the Community Management API. | Fetched Getting Access and Increasing Access | corrected |
| w_member_social is self-serve but can't post as an organization | Fetched Getting Access (open permissions) and a GitHub issue showing the HTTP 400 error | confirmed |
| Community Management can only be requested on an app without other products | Fetched Community Management overview FAQ #4 | confirmed |
| Refresh tokens are available to all apps Superseded by the independent check below: refresh tokens go to all approved Marketing Developer Platform apps (incl. Community Management). Access tokens last 60 days. | Fetched 3-legged OAuth doc | corrected |
| Development tier review takes 10-14 business days | Microsoft Q&A post (Aug 2026); no official page found | unverified |
| Programmatic refresh tokens are partner-only / limited set of partners Doc says all approved MDP partners get them (365-day refresh, 60-day access). An app approved for Community Management should receive them; self-serve apps do not. testMode and the token item updated. | Independent check: fetched LinkedIn 'Refresh Tokens with OAuth 2.0' on Microsoft Learn on 2026-10-30 | corrected |
| Development tier: 500 calls/app and 100/member per 24 h, no BATCH_GET, social-action webhooks off, 12 months to finish; Standard tier is discretionary | Independent check: fetched learn.microsoft.com/linkedin/marketing/increasing-access (version 2026-10) on 2026-10-30 | confirmed |
| A rejected Development or Standard tier request cannot be re-applied on the same app; create a new app A rejected Standard request sends you back to a new app and a new Development tier form. | Independent check: fetched learn.microsoft.com/linkedin/marketing/community-management-app-review on 2026-10-30 | confirmed |
| OAuth endpoint behaviour (discovery metadata, PKCE, dynamic registration, unknown-client handling) LinkedIn's OIDC discovery lives under /oauth (root .well-known paths 404) and lists only openid/profile/email; it advertises no PKCE methods and no dynamic registration. Unknown client_id on /oauth/v2/authorization returns HTTP 200 with an HTML page. | Endpoint probe: node scripts/probe.ts on 2026-10-30 | confirmed |
- Review times are undocumented. The '10-14 business days' figure is one developer's transcription of the portal dialog (Aug 2026); a GitHub issue guessed '1-5 business days'.
- Whether Sign In with LinkedIn can be added to the Community Management app after approval (the FAQ covers only the request time); we assume separate apps.
- Whether LinkedIn accepts http://localhost redirect URLs; docs only say to add them via HTTPS.
- Whether a multi-tenant tool (Iskaria posting for several clinics' Pages) needs anything beyond the standard Page Management use case. No test yet: Iskaria has only noted that Community Management needs an approved developer app.
- Marketing version 202511 sunsets 2026-11-16; check the current API version header (li-lms-2026-10 is current).
Sources
- l1Getting Access to LinkedIn APIs · official-docs · accessed 2026-10-30
“Open Permissions are the only permissions that are available to all developers without special approval.”
- l2Community Management - Overview · official-docs · accessed 2026-10-30
“with new developer applications that don't have access to other API products”
- l3Increasing Access (Marketing API tiers and permissions) · official-docs · accessed 2026-10-30
“You must complete your integration and testing within twelve months of receiving the API access.”
- l4Community Management App Review · provider-policy · accessed 2026-10-30
“our Community Management APIs are only available to registered legal organizations for commercial use cases only.”
- l5Marketing API Quick Start · official-docs · accessed 2026-10-30
“Access to a Company Page cannot be granted or updated through the API.”
- l6Share on LinkedIn · official-docs · accessed 2026-10-30
“Required to create a LinkedIn post on behalf of the authenticated member.”
- l7LinkedIn 3-Legged OAuth Flow · official-docs · accessed 2026-10-30
“Currently, all access tokens are issued with a 60-day lifespan.”
- l8Associate an app with a LinkedIn Page (Help) · provider-policy · accessed 2026-10-30
“Your page super admin has 30 days to approve the request to associate an app with a LinkedIn Page.”
- l9Restricted Uses of LinkedIn Marketing APIs and Data · provider-policy · accessed 2026-10-30
“member social activity data can only be stored for 48 hours”
- l10Microsoft Q&A: Community Management API access stuck at 'Access Form Review' (Aug 2026) · community · accessed 2026-10-30
“within 10-14 business days”
- l11GitHub issue: request Community Management API for w_organization_social (soleur #799) · community · accessed 2026-10-30
“Organization permissions must be used when using organization as author”
- l12Refresh Tokens with OAuth 2.0 (LinkedIn) · official-docs · accessed 2026-10-30
“LinkedIn supports programmatic refresh tokens for all approved Marketing Developer Platform (MDP) partners. ... access tokens are valid for 60 days and programmatic refresh tokens are valid for a year.”
- l13Endpoint probe, 2026-10-30 · our-test · accessed 2026-10-30
“openid-configuration at /oauth only; scopes_supported: [openid, profile, email]; no code_challenge_methods_supported; no registration_endpoint”