LinkedIn Pages may need separate OAuth credentials from personal LinkedIn

[samuelbushi]

Summary

LinkedIn Page support may need separate OAuth app credentials from personal LinkedIn profile support.

LinkedIn's developer portal currently indicates that the Community Management API must be the only product on the application for legal/security reasons. That conflicts with using the same LinkedIn developer app for both:

• personal profile posting (Share on LinkedIn, w_member_social)
• organization/page posting (Community Management API, w_organization_social, r_organization_social, rw_organization_admin)

Environment

• TryPost self-hosted v1.0.1
• New LinkedIn developer app
• Personal LinkedIn configured through LINKEDIN_CLIENT_ID / LINKEDIN_CLIENT_SECRET
• LinkedIn Page callback configured separately, but still uses the same client ID/secret.

Current TryPost behavior

config/services.php uses the same env vars for both drivers:

'linkedin' => [
    'client_id' => env('LINKEDIN_CLIENT_ID'),
    'client_secret' => env('LINKEDIN_CLIENT_SECRET'),
    'redirect' => env('LINKEDIN_CLIENT_REDIRECT'),
],

'linkedin-openid' => [
    'client_id' => env('LINKEDIN_CLIENT_ID'),
    'client_secret' => env('LINKEDIN_CLIENT_SECRET'),
    'redirect' => env('LINKEDIN_CLIENT_REDIRECT'),
    'redirect_page' => env('LINKEDIN_PAGE_CLIENT_REDIRECT'),
],

What happens

When requesting Community Management API in LinkedIn for a general app that already has other products, LinkedIn shows a message like:

This API product requires that it be the only product on the application for legal and security reasons.
This product cannot be requested because there are currently other provisioned products or other pending product requests.
A new developer application can be created to request this product.

This means a self-hosted TryPost instance may need one LinkedIn app for personal posting and a separate LinkedIn app for organization/page posting.

Expected behavior

TryPost should allow configuring separate credentials for LinkedIn personal and LinkedIn Page connections, for example:

LINKEDIN_CLIENT_ID=
LINKEDIN_CLIENT_SECRET=
LINKEDIN_CLIENT_REDIRECT=

LINKEDIN_PAGE_CLIENT_ID=
LINKEDIN_PAGE_CLIENT_SECRET=
LINKEDIN_PAGE_CLIENT_REDIRECT=

Suggested fix

Add optional LINKEDIN_PAGE_CLIENT_ID and LINKEDIN_PAGE_CLIENT_SECRET env vars. If absent, keep the current behavior for backward compatibility. If present, use those credentials for the LinkedIn Page driver/token exchange.

[paulocastellano]

@samuelbushi so the recommendation it's have two apps, one for personal and another one for pages right?

[samuelbushi]

@paulocastellano

Yes, that’s my understanding.

Linkedin personal posting can use one app with OpenID / Share on LinkedIn scopes like openid profile email w_member_social.

Linkedin pages seem to require the Community Management API, and Linkedin says that product must be the only product on the application. So in practice, pages need a separate linkedIn app.

[paulocastellano]

@samuelbushi right, i will improve that on next week, but you want make a PR?

[samuelbushi]

@paulocastellano sure! I can take this one

[paulocastellano]

I appreciate it @samuelbushi, thank you!