LinkedIn API 403 on /rest/posts: check the version header first

1. The version header

Every /rest/ call needs a LinkedIn-Version header in YYYYMM form and X-Restli-Protocol-Version: 2.0.0. On September 15, 2026 we sent a text post from a self-serve app (only Share on LinkedIn and Sign In with LinkedIn using OpenID Connect, scopes openid profile w_member_social) to /rest/posts with LinkedIn-Version: 202608, and it was accepted. That is the version OpenTweet sends today.

The context: an n8n community thread describes a self-serve app with the same products getting 403 on /rest/posts at LinkedIn-Version: 202504, worked around by falling back to /v2/ugcPosts. We cannot say for certain the version was the cause of that 403. What we can say is that the scope was not the wall, because the same scope posts at 202608.

curl -i -X POST https://api.linkedin.com/rest/posts \
  -H "Authorization: Bearer $LINKEDIN_TOKEN" \
  -H "LinkedIn-Version: 202608" \
  -H "X-Restli-Protocol-Version: 2.0.0" \
  -H "Content-Type: application/json" \
  -d '{
    "author": "urn:li:person:YOUR_MEMBER_ID",
    "commentary": "Testing the Posts API.",
    "visibility": "PUBLIC",
    "distribution": {
      "feedDistribution": "MAIN_FEED",
      "targetEntities": [],
      "thirdPartyDistributionChannels": []
    },
    "lifecycleState": "PUBLISHED",
    "isReshareDisabledByAuthor": false
  }'

A success is 201 with the post URN in the x-restli-id response header.

3 and 4. The scopes on the token

The scopes that matter are the ones on the token, not the ones listed on your app. LinkedIn’s token introspection endpoint returns them for a member token:

curl -X POST https://www.linkedin.com/oauth/v2/introspectToken \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "client_id=$CLIENT_ID" \
  --data-urlencode "client_secret=$CLIENT_SECRET" \
  --data-urlencode "token=$LINKEDIN_TOKEN"

# { "active": true, "status": "active",
#   "scope": "email,openid,profile,w_member_social", ... }

• No w_member_social in the list. Your sign-in URL did not ask for it. Add it to the scope parameter and make sure Share on LinkedIn shows as added on the app’s Products tab.
• The product was added after the token was issued. A token carries the scopes it was granted at sign-in, so it will not pick up w_member_social later. Compare created_at in the introspection response with when you added the product, then sign in again.
• The token is inactive. An expired or revoked token is a separate problem, and the introspection response settles it: active and status (active, expired or revoked) tell you directly.

The scope field is returned only for tokens from the 3-legged sign-in flow, which is what a member token is. You can also paste a token into the Token Inspector in LinkedIn’s Developer Portal tools to see the same scope list without writing code.

Or skip the LinkedIn app entirely

With OpenTweet there is no developer app, scope list or version header for you to manage. You connect LinkedIn once with a LinkedIn sign-in, then send the post through one API call. OpenTweet posts to your personal profile as urn:li:person, sends a working LinkedIn-Version, escapes the text and enforces LinkedIn’s 3,000-character limit before the call goes out.

curl -X POST https://opentweet.io/api/v1/posts \
  -H "Authorization: Bearer ot_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "text": "Testing the Posts API.",
    "platforms": ["linkedin"],
    "publish_now": true
  }'

OpenTweet posts to personal profiles only, not Company Pages. Add "x" and "bluesky" to the platforms array to send the same post there too.