Skip to main content

Get credentials

1

Create an application

Go to linkedin.com/developers/apps/new. You will need a LinkedIn Page associated with the app (create a company page if you do not have one).
2

Enable Sign In with LinkedIn

In your app dashboard, go to the Products tab and request access to Sign In with LinkedIn using OpenID Connect. This is usually granted immediately.
3

Add a redirect URL

Go to Auth > OAuth 2.0 settings. Under Authorized redirect URLs for your app, add:
https://auth.example.com/auth/oauth/linkedin/callback
4

Copy credentials

From the Auth tab, copy the Client ID and Client Secret.
LinkedIn’s legacy r_liteprofile and r_emailaddress scopes are deprecated. KavachOS uses the OpenID Connect flow with openid, profile, and email scopes, which requires the “Sign In with LinkedIn using OpenID Connect” product to be enabled on your app.

Configuration

lib/kavach.ts
import { createKavach } from 'kavachos';
import { oauth } from 'kavachos/auth';

const kavach = await createKavach({
  database: { provider: 'postgres', url: process.env.DATABASE_URL! },
  secret: process.env.KAVACH_SECRET!,
  baseUrl: 'https://auth.example.com',
  plugins: [
    oauth({
      providers: [
        {
          id: 'linkedin', 
          clientId: process.env.LINKEDIN_CLIENT_ID!, 
          clientSecret: process.env.LINKEDIN_CLIENT_SECRET!, 
        },
      ],
    }),
  ],
});
LINKEDIN_CLIENT_ID=...
LINKEDIN_CLIENT_SECRET=...

Scopes

Default scopes: openid profile email
ScopeWhat it unlocks
openidOpenID Connect identity
profileName and profile picture
emailPrimary email address

User data returned

FieldSourceNotes
idsub claimStable LinkedIn member ID
emailemail claimPrimary email (verified)
namename claimFull name
imagepicture claimProfile photo URL
LinkedIn profile photos are hosted on their CDN and may require authentication headers to load in <img> tags depending on the user’s privacy settings. Store the URL in your database but be prepared for it to become inaccessible.
Last modified on April 17, 2026