If you're building an agent that posts to someone's own LinkedIn profile, the permission you can add yourself is
w_member_social. It covers more than most developers expect: photos, video, documents and polls as well as text. A
few things people expect it to cover need permissions or partner access that aren't available through that self-serve
product.
Every LinkedIn fact here comes from LinkedIn's own documentation (API version 202610), checked on October 25, 2026. LinkedIn ships a new API version every month, so check the linked page before you build on it.
The short answer
w_member_socialcovers text with hashtags and company mentions, one photo, 2 to 20 photos, one video, a document, a poll, a link card, and a repost with your own text.- Comments need
w_member_social_feed, including the "link in the first comment" habit. - Posting as a company page needs
w_organization_socialand an admin role on the page. - Tagging people needs a member's person ID from the publishing app;
w_member_socialcan publish the resolved mention, but cannot look up arbitrary people. - Reading posts back needs
r_member_social, which LinkedIn isn't granting.
The last four come with LinkedIn's vetted Community Management API, or not at all.
Getting w_member_social
Add the Share on LinkedIn
product to your app in LinkedIn's Developer Portal. It grants w_member_social, "required to create a LinkedIn post on
behalf of the authenticated member", as a self-serve product. To fill in the post's author you need the member's person ID,
which Sign In with LinkedIn using OpenID Connect
gives you: its profile scope returns the member's id, name and photo.
The Share on LinkedIn page still shows the older ugcPosts endpoint, and lists a limit of 150 requests per member and
100,000 per app each UTC day. New work should use the
Posts API
(POST /), which replaces ugcPosts and lists w_member_social for posting as a member. Its calls need the
Linkedin-Version (a month, like 202610) and X-Restli-Protocol-Version: 2.0.0 headers.
What w_member_social covers
Each of these pages lists w_member_social for posts by a member. In the
post schema,
content holds one of them (media, multiImage, poll or article) next to the text.
| Content | LinkedIn API | What LinkedIn's docs say |
|---|---|---|
| Text | Posts API | commentary uses the little text format: reserved characters are escaped with a backslash, #word is a hashtag |
| Company mentions | Posts API | @[Exact Name](urn:li:organization:ID). The name must match the page's full name, case sensitive, or it posts as plain text |
| One photo | Images API | Upload first, then post its image URN. JPG, GIF or PNG under 36,152,320 pixels; alt text up to 4,086 characters |
| 2 to 20 photos | MultiImage API | Organic posts only; carousels are for ads |
| Video | Videos API | MP4, 3 seconds to 30 minutes, 75 KB to 500 MB, uploaded in the byte ranges LinkedIn returns. Captions and a thumbnail are optional |
| Document | Documents API | PDF, PPT, PPTX, DOC or DOCX, up to 100 MB and 300 pages. The member who posts must own the upload |
| Poll | Poll API | A question of up to 140 characters, 2 to 4 options of up to 30 characters, open for 1, 3, 7 or 14 days. It can't be edited, and the author sees who voted for what |
| Link card | Posts API (article) |
LinkedIn doesn't read the link for you: you send the title, description and a thumbnail uploaded through the Images API |
| Repost with your text | Posts API (reshareContext) |
The original post's URN goes in reshareContext. The author can turn resharing off, and visibility can still block it |
Image uploads aren't image reads. LinkedIn's Images API says w_member_social is write-only: a token with only
that permission can't make a versioned GET / call, even for an image it just uploaded. The same page says
w_member_social is enough for legacy GET calls to rest/.
Reposts are writes, too. The Posts API documents reshareContext under the same member-write permission;
it doesn't document an extra w_member_social_feed requirement for creating the repost. Checking that the original
post exists and is eligible to reshare is a separate read, with the restrictions below.
What needs other permissions
| What | Permission | Where it comes from |
|---|---|---|
| Comments, including a first comment under your own post | w_member_social_feed |
Community Management API |
| Reactions and likes | w_member_social_feed |
Community Management API |
| Posting as a company page | w_organization_social, with an administrator, content admin or sponsored-content poster role on the page |
Community Management API |
| Tagging people | w_member_social to publish a known person URN; r_organization_followers for the documented lookup |
Restricted People Typeahead access, an eligible Page role, and only that Page's followers |
| Reading the member's posts, or checking a post before reposting it | r_member_social |
Closed to new requests |
Comments. The Posts, Documents and Poll pages still describe w_member_social as "post, comment, and like", but the
Comments API
lists w_member_social_feed for a member's comments, and LinkedIn's
Community Management migration guide
moved creating and deleting comments, likes and reactions from w_member_social to w_member_social_feed in June 2023.
The docs make no exception for your own post. Plan on w_member_social_feed.
Company pages. Posting as a page needs w_organization_social, and works only for pages where the signed-in member
is an administrator, content admin or direct sponsored content poster. Mentioning a company in a member's post doesn't
need it.
People. The little text format accepts @[Name](urn:li:person:ID), so the post itself can carry a person mention.
The catch is the ID. LinkedIn's
Profile API says another member's
person ID is "available only via certain limited access APIs", and each ID works only in the app that received it. The
one documented lookup, the
People Typeahead API,
is restricted to select developers and requires r_organization_followers with an administrator or direct sponsored content poster role. Both its keyword search and profile-URL lookup find only that Page's followers. A profile's vanity name is not a person ID.
Publishing an already-resolved urn:li:person:ID uses w_member_social; no separate person-mention write permission is documented. The name must match LinkedIn's case-sensitive name rules. The Community Management access page lists r_organization_followers among permissions granted on approval, but the endpoint page still restricts access to selected developers: Development approval alone is not proof the lookup works. These mention requirements were checked on October 31, 2026.
Reading posts. Reading a member's posts takes r_member_social. LinkedIn's
Community Management overview
calls it "a closed permission" and isn't accepting requests. So an app can post for a member but can't read the post
back. Nor can it read someone else's post first, to check that it exists and allows resharing before reposting it.
Who can get the Community Management API. Per LinkedIn's app review page, it's "only available to registered legal organizations for commercial use cases". LinkedIn verifies your business email address (personal addresses don't pass), your organization and its website, and a super admin of your company's LinkedIn Page verifies the app. Its Development tier allows 500 calls per app and 100 per member a day, and Standard tier needs a screen recording of your app reviewed. LinkedIn asks you to request it from a new app that has no other API products.
What Flaghand does with LinkedIn
Flaghand is a publishing desk where AI agents draft posts and only the owner can approve them. Its LinkedIn app uses
Share on LinkedIn and Sign In with OpenID Connect (openid, profile, w_member_social) and the Posts API, version
202610. This table describes its implementation as of October 31, 2026;
it doesn't count features in open pull requests.
| Flaghand today | |
|---|---|
| Text with hashtags | Yes |
| Company mentions | Yes. Each @[Page] is linked to the page's exact name and organization URN, which you supply; Flaghand doesn't read LinkedIn pages outside its API |
| Photos | 1 to 20, with alt text |
| Video | One MP4. Flaghand's upload currently accepts files up to 50 MB |
| Link card | Yes, with the title, description and image you set. Not with a video |
| Documents | One PDF, uploaded or exported from Flaghand slides. Up to 300 pages; Flaghand's upload currently accepts files up to 50 MB |
| Polls | Yes. A question of up to 140 characters, 2 to 4 options of up to 30, open for 1, 3, 7 or 14 days, with no photo, video, link card or document beside it |
| First comment | No: it needs w_member_social_feed |
| Repost with your text | No: Flaghand checks each draft before approval, and can't check the original post without r_member_social |
| Posting as a company page | No |
| Tagging people | With a supplied, app-scoped person URN and matching name; without one, the name posts as plain text (no link or notification): edit the live post on LinkedIn to add the @mention, then record the edited text in Flaghand with recordLiveEdit |
| Reading the post back | No. X posts are read back; LinkedIn posts can't be |
Flaghand's publishing app has no other-person lookup grant. Its separate Community Management app received Development approval on October 30, 2026, but its r_organization_followers grant and selected-developer People Typeahead entitlement have not been verified. Development approval is not proof that lookup works, and person IDs obtained under that app cannot be moved to the publishing app. Person tags without a URN produce a non-blocking Check warning repeated in the approval snapshot before the passkey tap; there is no extra confirmation.
Flaghand waits for each photo to finish processing before it posts, and if LinkedIn refuses the upload or the status check, it doesn't post.
A post carries photos, one video, one PDF or a link card, not a mixture. Check flags supported validation problems before approval: length, mentions that aren't linked, people tags, video format, size and length, and PDF format and page count.
An agent drafts through Flaghand's API, CLI or MCP server, and its token can't publish: you approve the exact post with your passkey, and Flaghand posts it at the approved time. The agent documentation covers the API and the MCP server, and the drafts and media reference has the full LinkedIn format. How to let an AI agent post on social media safely has nine checks to run on any tool, this one included. Flaghand is in early access, and anyone can start a free trial. Get access to Flaghand.