Skip to content

LinkedIn Secret Key

Service Name: LinkedIn

Service Description: LinkedIn is a professional networking platform that allows users to connect with colleagues, search for jobs, and share professional content. The LinkedIn API enables developers to build applications that interact with LinkedIn's platform.

Service Address: https://www.linkedin.com/

Validation Type: API Auth

IP Allow list: IP restrictions can be configured at the application level in the LinkedIn Developer Portal

Secret Access Scope: Grants access to LinkedIn's API for performing actions like retrieving profile information, posting content, or managing company pages, depending on the permissions granted to the application.

Secret Revokement URL: https://www.linkedin.com/developers/apps/

Secret Example: c8ed5a778df14a23b8ff74d63a5a455b

Suspicious Activity Investigation Instructions:

  • Review the LinkedIn Developer Portal for unusual API usage patterns
  • Check application settings for unauthorized changes to redirect URLs or permissions
  • Monitor for unexpected posts, messages, or connections made through the application
  • Review OAuth access token usage in application logs
  • Check for unusual geographic access patterns to your LinkedIn application

Mitigation Instructions:

  • Log in to the LinkedIn Developer Portal at

https://www.linkedin.com/developers/apps/

  • Select the affected application
  • Navigate to the Auth tab
  • Click "Generate New Client Secret" to invalidate the compromised secret
  • Update your application with the new client secret
  • Review and potentially reduce the OAuth scopes requested by your application
  • Enable additional security measures like IP restrictions if available
  • Update any stored credentials in your application's environment variables or

secrets management system