How to Generate Refresh token in LinkedIn?

Question

How to Generate Refresh token in LinkedIn?

VIGNESH G 40

In the LinkedIn Developer Portal, I created an application and selected the required API access from the Products tab. I also verified my LinkedIn account and generated an access token. However, the access token is only valid for two months.

I understand that if I obtain a refresh token, I can use it to generate new access tokens for up to 365 days. Could you guide me through the process of generating a refresh token and explain any prerequisites or settings that need to be enabled?

0 comments

1 answer

Your answer

Answer 1

To get a LinkedIn refresh token, the app must be approved for programmatic refresh tokens. LinkedIn states that programmatic refresh tokens are supported for approved Marketing Developer Platform (MDP) partners.

The process is:

Use the Authorization Code Flow Start the standard OAuth 2.0 authorization code flow for the app.
Exchange the authorization code for tokens If the app is authorized for programmatic refresh tokens, the token response includes:
- access_token
- refresh_token
- refresh_token_expires_in
- scope
Store the tokens securely Store both access and refresh tokens encrypted at rest in a secure backend database. Do not store them in client-side storage such as cookies, localStorage, or sessionStorage.

Use the refresh token to get a new access token Send an HTTP POST request to:

   POST https://www.linkedin.com/oauth/v2/accessToken
   Content-Type: application/x-www-form-urlencoded

Required form fields:

grant_type=refresh_token
refresh_token=<REFRESH_TOKEN>
client_id=<CLIENT_ID>
client_secret=<CLIENT_SECRET>

Example:

   curl -X POST "https://www.linkedin.com/oauth/v2/accessToken" \
     -H "Content-Type: application/x-www-form-urlencoded" \
     --data-urlencode 'grant_type=refresh_token' \
     --data-urlencode 'refresh_token=<REFRESH_TOKEN>' \
     --data-urlencode 'client_id=<CLIENT_ID>' \
     --data-urlencode 'client_secret=<CLIENT_SECRET>'

Key prerequisites and behavior:

Approval is required: refresh tokens are not described as a general Developer Portal toggle; they are available for apps authorized for programmatic refresh tokens.
Access token lifetime: typically 60 days.
Refresh token lifetime: typically 365 days.
Refreshing does not extend the refresh token lifetime: the refresh token keeps the original 365-day TTL window.
Reauthorization is required when the refresh token expires.
LinkedIn can revoke access or refresh tokens for technical or policy reasons, so the app should fall back to the standard OAuth flow when needed.
Token size: refresh tokens are about 500 characters long, and the application should support at least 1000 characters for token fields.

If only an access token was generated from the Developer Portal token generator, that does not by itself indicate that a refresh token is enabled for the app. The documented way to obtain a refresh token is through the authorization code exchange, and only when the app is authorized for programmatic refresh tokens.

For monitoring and validation:

The Developer Portal includes a Token Inspector tool.
The Developer Portal analytics dashboard includes OAuth refresh token usage information, including quota usage and throttling state.

References: