Flaghand

Updated

Posting to LinkedIn through its API: what a personal profile can do

If you're building an agent that posts to someone's own LinkedIn profile, the permission you can add yourself is w_member_social. It covers more than most developers expect: photos, video, documents and polls as well as text. A few things people expect it to cover need permissions or partner access that aren't available through that self-serve product.

Every LinkedIn fact here comes from LinkedIn's own documentation (API version 202610), checked on October 25, 2026. LinkedIn ships a new API version every month, so check the linked page before you build on it.

The short answer

The last four come with LinkedIn's vetted Community Management API, or not at all.

Getting w_member_social

Add the Share on LinkedIn product to your app in LinkedIn's Developer Portal. It grants w_member_social, "required to create a LinkedIn post on behalf of the authenticated member", as a self-serve product. To fill in the post's author you need the member's person ID, which Sign In with LinkedIn using OpenID Connect gives you: its profile scope returns the member's id, name and photo.

The Share on LinkedIn page still shows the older ugcPosts endpoint, and lists a limit of 150 requests per member and 100,000 per app each UTC day. New work should use the Posts API (POST /rest/posts), which replaces ugcPosts and lists w_member_social for posting as a member. Its calls need the Linkedin-Version (a month, like 202610) and X-Restli-Protocol-Version: 2.0.0 headers.

What w_member_social covers

Each of these pages lists w_member_social for posts by a member. In the post schema, content holds one of them (media, multiImage, poll or article) next to the text.

Content LinkedIn API What LinkedIn's docs say
Text Posts API commentary uses the little text format: reserved characters are escaped with a backslash, #word is a hashtag
Company mentions Posts API @[Exact Name](urn:li:organization:ID). The name must match the page's full name, case sensitive, or it posts as plain text
One photo Images API Upload first, then post its image URN. JPG, GIF or PNG under 36,152,320 pixels; alt text up to 4,086 characters
2 to 20 photos MultiImage API Organic posts only; carousels are for ads
Video Videos API MP4, 3 seconds to 30 minutes, 75 KB to 500 MB, uploaded in the byte ranges LinkedIn returns. Captions and a thumbnail are optional
Document Documents API PDF, PPT, PPTX, DOC or DOCX, up to 100 MB and 300 pages. The member who posts must own the upload
Poll Poll API A question of up to 140 characters, 2 to 4 options of up to 30 characters, open for 1, 3, 7 or 14 days. It can't be edited, and the author sees who voted for what
Link card Posts API (article) LinkedIn doesn't read the link for you: you send the title, description and a thumbnail uploaded through the Images API
Repost with your text Posts API (reshareContext.parent) The original post's URN goes in reshareContext.parent. The author can turn resharing off, and visibility can still block it

Image uploads aren't image reads. LinkedIn's Images API says w_member_social is write-only: a token with only that permission can't make a versioned GET /rest/images call, even for an image it just uploaded. The same page says w_member_social is enough for legacy GET calls to rest/images.

Reposts are writes, too. The Posts API documents reshareContext.parent under the same member-write permission; it doesn't document an extra w_member_social_feed requirement for creating the repost. Checking that the original post exists and is eligible to reshare is a separate read, with the restrictions below.

What needs other permissions

What Permission Where it comes from
Comments, including a first comment under your own post w_member_social_feed Community Management API
Reactions and likes w_member_social_feed Community Management API
Posting as a company page w_organization_social, with an administrator, content admin or sponsored-content poster role on the page Community Management API
Tagging people The member's person ID Only through limited-access APIs
Reading the member's posts, or checking a post before reposting it r_member_social Closed to new requests

Comments. The Posts, Documents and Poll pages still describe w_member_social as "post, comment, and like", but the Comments API lists w_member_social_feed for a member's comments, and LinkedIn's Community Management migration guide moved creating and deleting comments, likes and reactions from w_member_social to w_member_social_feed in June 2023. The docs make no exception for your own post. Plan on w_member_social_feed.

Company pages. Posting as a page needs w_organization_social, and works only for pages where the signed-in member is an administrator, content admin or direct sponsored content poster. Mentioning a company in a member's post doesn't need it.

People. The little text format accepts @[Name](urn:li:person:ID), so the post itself can carry a person mention. The catch is the ID. LinkedIn's Profile API says another member's person ID is "available only via certain limited access APIs", and each ID works only in the app that received it. The one documented lookup, the People Typeahead API, is restricted to select developers, and finds only a company page's followers, for the people who manage that page. Without an ID, a name posts as plain text.

Reading posts. Reading a member's posts takes r_member_social. LinkedIn's Community Management overview calls it "a closed permission" and isn't accepting requests. So an app can post for a member but can't read the post back. Nor can it read someone else's post first, to check that it exists and allows resharing before reposting it.

Who can get the Community Management API. Per LinkedIn's app review page, it's "only available to registered legal organizations for commercial use cases". LinkedIn verifies your business email address (personal addresses don't pass), your organization and its website, and a super admin of your company's LinkedIn Page verifies the app. Its Development tier allows 500 calls per app and 100 per member a day, and Standard tier needs a screen recording of your app reviewed. LinkedIn asks you to request it from a new app that has no other API products.

What Flaghand does with LinkedIn

Flaghand is a publishing desk where AI agents draft posts and only the owner can approve them. Its LinkedIn app uses Share on LinkedIn and Sign In with OpenID Connect (openid, profile, w_member_social) and the Posts API, version 202610. This table describes its merged implementation on October 26, 2026, checked against its public API description; it doesn't count features in open pull requests.

Flaghand today
Text with hashtags Yes
Company mentions Yes. Each @[Page] is linked to the page's exact name and organization URN, which you supply; Flaghand doesn't read LinkedIn pages outside its API
Photos 1 to 20, with alt text
Video One MP4. Flaghand's upload currently accepts files up to 50 MB
Link card Yes, with the title, description and image you set. Not with a video
Documents One PDF, uploaded or exported from Flaghand slides. Up to 300 pages; Flaghand's upload currently accepts files up to 50 MB
Polls Yes. A question of up to 140 characters, 2 to 4 options of up to 30, open for 1, 3, 7 or 14 days, with no photo, video, link card or document beside it
First comment No: it needs w_member_social_feed
Repost with your text No: Flaghand checks each draft before approval, and can't check the original post without r_member_social
Posting as a company page No
Tagging people No. Check flags a person tag and offers to have you post it yourself in LinkedIn, or to change it to a plain name
Reading the post back No. X posts are read back; LinkedIn posts can't be

Flaghand waits for each photo to finish processing before it posts, and if LinkedIn refuses the upload or the status check, it doesn't post.

A post carries photos, one video, one PDF or a link card, not a mixture. Check flags supported validation problems before approval: length, mentions that aren't linked, people tags, video format, size and length, and PDF format and page count.

An agent drafts through Flaghand's API, CLI or MCP server, and its token can't publish: you approve the exact post with your passkey, and Flaghand posts it at the approved time. The agent documentation covers the API and the MCP server, and the drafts and media reference has the full LinkedIn format. How to let an AI agent post on social media safely has nine checks to run on any tool, this one included. Flaghand is in early access, and sign-up isn't open yet. Get access to Flaghand.