Why a LinkedIn Access Token Expires After 60 Days

How long does a LinkedIn access token last?

Every LinkedIn access token minted through the authorization code flow carries the same clock, and LinkedIn states the figure without qualification: "Currently, all access tokens are issued with a 60-day lifespan." That line sits in the response-field table for expires_in on the three-legged OAuth page, which is the flow any posting integration uses.

The sample response LinkedIn publishes on that page matches the sentence to the second:

{
  "access_token":"AQUvlL_DYEzvT2wz1QJiEPeLioeA",
  "expires_in":5184000,
  "scope":"r_basicprofile"
}

5,184,000 seconds is 60 days exactly, with nothing shaved off. Read the field rather than the sentence, though. LinkedIn's own guidance says "Access tokens stay valid until the number of seconds indicated in the expires_in field in the API response," and expires_in is the only value that reflects what your token actually got.

Which LinkedIn tokens have which lifetime?

There are three, and they are nothing like each other.

The authorization code is the one people trip over first. LinkedIn writes that "the authorization code has a 30-minute lifespan and must be used immediately," and that if it expires "you must repeat all of the previous steps to request another authorization code."

The two-legged token is a different kind of surprise. LinkedIn's client credentials page says "The access token has a 30-minute lifespan and must be used immediately," and its sample returns "expires_in": "1800" as a quoted string rather than the integer the three-legged flow returns. Two-legged is also unavailable for the APIs most posting tools need: "2-legged OAuth authentication is not available for Marketing APIs."

Does LinkedIn give you a refresh token?

Only if LinkedIn has approved you for one. The refresh token page opens with the gate: "LinkedIn supports programmatic refresh tokens for all approved Marketing Developer Platform (MDP) partners," and the authorization code flow page repeats it from the other side, saying programmatic refresh tokens "are available for a limited set of partners."

If your app is not in that group, LinkedIn's documented refresh path is not a grant type at all. It is sending the member back through /oauth/v2/authorization. LinkedIn describes this as seamless, and it genuinely can be, because the consent screen is skipped when two conditions hold: "The member is still logged into www.linkedin.com" and "The member's current access token has not expired." Miss either one and your user sees the full authorization screen again.

Which is why LinkedIn's own advice is to refresh early: "Make sure your application refreshes access tokens before they expire, to avoid unnecessarily sending your application's users through the authorization process again." A token refreshed on day 55 renews silently. A token refreshed on day 61 cannot renew at all.

Approved partners exchange the refresh token instead:

POST https://www.linkedin.com/oauth/v2/accessToken
 
Content-Type: application/x-www-form-urlencoded
grant_type=refresh_token&refresh_token={refresh_token}&client_id={client_id}&client_secret={client_secret}

How long does the LinkedIn refresh token last?

365 days, and the clock never resets. LinkedIn writes that "access tokens are valid for 60 days and programmatic refresh tokens are valid for a year," then spells out the consequence that catches people: "When you use a refresh token to generate a new access token, the lifespan or Time To Live (TTL) of the refresh token remains the same as specified in the initial OAuth flow (365 days), and the new access token has a new TTL of 60 days."

LinkedIn's worked example is worth reading literally:

• Day 1: refresh token has 365 days, access token has 60.
• Day 59: refreshing gives a new 60-day access token, and the refresh token is down to 306 days.
• Day 360: "your access token and refresh token will both expire in 5 days (365-360=5) and you must get your application reauthorized by the member."

So a refresh token buys you roughly six silent renewals and then the member has to click Allow again. There is no rolling window, no refresh token rotation that extends the horizon, and no documented way to ask for more.

What does refresh_token_expires_in actually return?

Here LinkedIn contradicts itself, and the arithmetic makes it obvious. The field is documented as "The number of seconds remaining until the refresh token expires." The sample response on the same page returns:

{
  "refresh_token_expires_in": 525600,
  "scope":"r_basicprofile"
}

525,600 seconds is 6.08 days, which is not a year and not any documented LinkedIn lifetime. 525,600 minutes is exactly 365 days. The sample is in minutes while the field description says seconds.

The second sample seals it. After a refresh, LinkedIn's page shows "refresh_token_expires_in": 439200. The difference between the two values is 86,400, and 86,400 minutes is 60 days, which is precisely the gap the worked example describes between issuing a refresh token and using it once. Both sample values are internally consistent as minutes and nonsense as seconds.

Treat the field description as authoritative and the sample numbers as a documentation slip. If you are storing an absolute expiry, compute it from what the live API returns to you, not from either figure on that page.

What invalidates a LinkedIn access token before 60 days?

Four things, all documented.

Requesting a different scope is the one that surprises developers, because nothing visibly breaks until it does. LinkedIn writes: "If you request a different scope than the previously granted scope, all the previous access tokens are invalidated." Shipping a release that adds one permission kills every token your existing users hold. The same page warns separately that "If the scope permissions are changed in your app, your users must re-authenticate."

Revocation by LinkedIn is the second, and LinkedIn is blunt about reserving it: "LinkedIn reserves the right to revoke Refresh Tokens or Access Tokens at any time due to technical or policy reasons. In such scenarios, the expectation from products leveraging Refresh Tokens is to fallback to the standard OAuth flow, and present the login screen to the end users."

Revocation by the member is the third. A member who disconnects your app in their LinkedIn settings ends the grant immediately.

A refresh attempt with a dead credential is the fourth, and it returns a specific error: 400 invalid_request "The provided authorization grant or refresh token is invalid, expired or revoked". LinkedIn's resolution column offers exactly one remedy, "reauthenticate the member to generate the new refresh token."

You do not have to guess which of the four happened. POST https://www.linkedin.com/oauth/v2/introspectToken takes your client_id, client_secret and the token itself, and returns status as revoked, expired or active, alongside expires_at, created_at, authorized_at and auth_type. That is the call to make when scheduled LinkedIn posts stop working for one account and no one else.

How does this differ from Meta's 60-day token?

Both platforms say 60 days. Almost nothing else lines up.

Meta's number is the odd one. Its sample response returns "expires_in": 5183944, which is 56 seconds short of 60 days, and Meta's phrasing is deliberately loose: "long-lived tokens last about 60 days." Meta then adds a caveat LinkedIn does not, telling you not to depend on the lifetime because tokens "may change without warning or expire early." The full breakdown lives in the note on the Facebook long lived access token.

The real divergence is what you get at the end of the chain. Meta lets you derive a Page access token from a long-lived user token, and says those "do not have an expiration date." LinkedIn publishes no equivalent and says the opposite in a single line on the refresh section: "To protect members' data, LinkedIn does not generate long-lived access tokens." LinkedIn is describing its own 60-day token as short-lived.

For anyone building against both, the practical shape is this. On Meta you can reach a credential that outlives the member's session. On LinkedIn you cannot, so the reconnect prompt is a permanent feature of the integration rather than a failure state, and scheduling LinkedIn posts reliably means planning for the day the member has to click Allow again.

Frequently asked questions

What value does expires_in return for a LinkedIn access token?

5184000 in LinkedIn's published sample, which is exactly 60 days in seconds.

Can you extend a LinkedIn access token past 60 days?

No. LinkedIn issues a new 60-day token, either through a refresh token if your app is an approved MDP partner or by sending the member through authorization again.

How long is a LinkedIn authorization code valid?

30 minutes. LinkedIn writes that it "must be used immediately" and that an expired code means repeating every earlier step.

Does refreshing reset the refresh token's expiry?

No. LinkedIn states the refresh token TTL "remains the same as specified in the initial OAuth flow (365 days)" no matter how often you use it.

Why did all your LinkedIn tokens stop working at once?

The most likely cause is a scope change. LinkedIn invalidates all previously granted access tokens when your app requests a scope different from the one already granted.

How do you check whether a token is revoked or expired?

Call POST https://www.linkedin.com/oauth/v2/introspectToken with your client credentials and the token. The status field returns revoked, expired or active.

What happens when a LinkedIn refresh token expires alongside the access token?

LinkedIn's own example puts this at day 360, when both the access token and the refresh token have five days left. Once that window closes, the member has to go through authorization again, since no grant type can renew an expired refresh token. There is no extension path documented anywhere on the refresh token page.

Why can't most posting tools rely on LinkedIn's two-legged token?

The client credentials token lasts only 30 minutes and LinkedIn documents it as unavailable for Marketing APIs, the surface scheduling and posting tools depend on. Its sample response even returns expires_in as a quoted string, "1800", instead of the integer the three-legged flow uses. Any app that posts on a member's behalf has to use the three-legged flow instead.

Does LinkedIn's 5,184,000-second figure line up with its 60-day claim?

It matches exactly. LinkedIn's documentation states a 60-day lifespan and its sample expires_in value of 5184000 seconds converts to precisely 60 days, with no rounding. That precision is part of what makes the refresh_token_expires_in field's minutes-versus-seconds mismatch stand out later in the same documentation set.

Does LinkedIn ever issue a token that never expires?

LinkedIn documents no such option. Every access token carries a 60-day lifespan and the company states outright that it does not generate long-lived access tokens, unlike Meta, which lets you derive a Page access token with no expiration date from a long-lived user token.