Knowledge & tools

LinkedIn tool

The LinkedIn tool lets an agent publish and engage on a LinkedIn member profile - a person, not a company page. It can post text, images, video and article links, comment and reply, react, and delete what it created. One tool configuration maps to one LinkedIn member, with eight actions in total. Set it up once with credentials from the LinkedIn Developer Portal, then assign it to a bot.

This tool is write-only - it can publish, but it cannot read. The agent can post, comment, react and delete, but it can't read feeds or timelines, list its own posts, or see the comments and reactions on anything, even its own posts. This is a LinkedIn restriction, not a Hania one: LinkedIn grants read access only to vetted partners, and that permission is closed to new applicants. It applies to every integration of this type. So "did anyone comment on my post?" is a question the agent genuinely can't answer - it works from what it published and what you paste in.

What it can and can't do

What the agent can do (8 actions):

get_me - the connected member's name, email and photo.
post - publish plain text (up to ~3,000 characters), or a post with an article link (a rendered preview card with a custom title and description), or one or more images (public URLs, uploaded automatically), or a video (public URL). Visibility is PUBLIC (default) or CONNECTIONS.
delete_post - delete a post the tool created, using the id returned when it was published.
comment - comment on any LinkedIn post, including one you just paste the URL of (the id is extracted from the URL automatically).
reply_comment - reply to an existing comment, using the URN returned when it was created.
delete_comment - delete the member's own comments.
like / unlike - react to any post (URL pasting works here too).

What it can't do - these all need LinkedIn partner access the tool doesn't have:

Read anything - no feeds, no timelines, no listing your posts, no reading comments, reactions or engagement metrics, even on the agent's own posts.
Search LinkedIn - there's no search API at this tier.
Messaging / DMs - there's no self-serve API for it.
Company pages - posting or reading as an organization needs LinkedIn's vetted Community Management API. See Company pages.

Before you start

You need:

The LinkedIn member account the agent will post as.
A LinkedIn company page - creating a developer app requires one to associate it with (the app still posts as the member, not the page).
Access to the LinkedIn Developer Portal (linkedin.com/developers/apps).

Connect a profile

Create an app at linkedin.com/developers/apps, associated with a LinkedIn company page.
Check the Auth tab, not the Products tab. The Products tab may show only documentation links - the Auth tab's "OAuth 2.0 scopes" list is the ground truth. Confirm the app has openid, profile, email and w_member_social. In a normal setup these are available without adding any product.
Copy the Client ID and Primary Client Secret from the Auth tab.
Generate tokens. Open the Token Generator, select the app, tick openid profile email w_member_social, and approve as the member the agent should post as. Copy the refresh token (and the access token, if you want the fallback).
Paste Client ID + Client Secret + Refresh Token into the Hania form and save. There's no browser authorization step to complete afterward.

LinkedIn updates the Developer Portal from time to time, so treat the tab and section names above as authoritative and the exact labels as approximate - find the named section if a label has moved.

Once a year: renew the refresh token

The refresh token lasts about a year. Hania mints short-lived access tokens from it automatically the rest of the time, so day to day there's nothing to do - but before that year is up, the token has to be renewed or posting stops. When it expires you'll see a token refresh failure in the trace. The fix is two clicks: reopen the Token Generator, regenerate the refresh token for the same app and member, and re-paste it into the tool configuration.

Field reference

The tool configuration has four fields. Client ID and Client Secret are always required; then supply a Refresh Token (recommended) or an Access Token.

Client ID (required) - from the LinkedIn Developer Portal app's Auth tab (Application credentials).
Client Secret (required, secret) - the app's Primary Client Secret. Stored encrypted and never returned.
Refresh Token (recommended, secret) - from the Developer Portal Token Generator (scopes openid, profile, email, w_member_social). It lasts about a year, and access tokens are minted from it automatically. Regenerate and re-paste before it expires.
Access Token (optional, secret) - only needed if no Refresh Token is set: a 60-day access token from the Token Generator, used as-is until it expires. The refresh-token path is better because it lasts far longer.

Working with the agent

Because the tool can't read, a few practical patterns make it work smoothly:

Paste a URL to engage. To have the agent comment on, reply to, or react to a post - yours or someone else's - paste the post's URL. The agent pulls the id from the URL and acts on it.
The agent remembers what it published. Deleting a post needs the id from when it was created, which the agent keeps in the conversation and memory. A post published outside Hania can be engaged with by URL, but not deleted - the tool only deletes posts it created.
Ask it to report, and it'll tell you the truth. "Did anyone comment on my post?" can't be answered from the API; the LinkedIn Content Publisher blueprint has the agent say so plainly and ask you to paste the comment if you'd like it to reply.
Confirmations before anything goes live. Publishing to a real professional profile is high-stakes, so the blueprint has the agent confirm with you before it posts, comments or deletes.
Rate limit. LinkedIn allows about 150 API requests per member per day - ample for publishing workflows.

Company pages - not yet

Today the tool works with personal member profiles only. Posting or reading as a company page (an organization) requires LinkedIn's vetted Community Management API, which means a Standard-tier application with business verification and a screencast review. This isn't a toggle we've hidden - it depends on LinkedIn partner approval. If that approval is obtained, organization actions can be added; the backend has the upgrade path documented.

Troubleshooting

Token refresh failure - the refresh token expired or was pasted wrong. Regenerate it in the Token Generator and re-paste; LinkedIn's error message says exactly this.
ACCESS_DENIED on an action - the token was generated without the w_member_social scope. Regenerate it with all four scopes ticked.
A read request fails with a permission error - expected. Reading isn't available at this tier (see the write-only note at the top); have the agent work from what it created or what you paste.
Validation errors (missing text, an article link combined with an image, a bad visibility value, an unparseable post URL) - the agent self-corrects these, so they may flash through a trace before the call succeeds. Error text comes verbatim from LinkedIn.

Safety in autonomous runs

Like any tool, the LinkedIn tool carries a safety classification (read-only / destructive / sends-data-externally) that governs scheduled or triggered (autonomous) runs. Because deletes are irreversible and publishing to a professional profile is high-stakes, a new configuration is created with Read-only switched off, Destructive switched on, and Sends data externally on - so destructive actions are gated in autonomous runs unless the bot's "Allow destructive actions in autonomous runs" is enabled. Keep those defaults, and let the blueprint's confirmation prompts do their job before anything is published. Interactive chat is never gated by these flags.

Security

The Client Secret, Refresh Token and Access Token are stored AES-encrypted at rest and are never returned by the API - the console shows only whether each is set. Editing a configuration without retyping a secret preserves the stored one, so you must retype it to replace it. To revoke access, remove the app's authorization in LinkedIn or delete the app in the Developer Portal.

Blueprint

The fastest way to a working profile agent is the LinkedIn Content Publisher blueprint (content-publishing category) - a pre-built agent wired for publishing and engagement, including the confirm-before-posting habit and the honest handling of read requests described above. Pick it from the blueprint gallery when creating a bot; the only thing you supply is the credentials from this guide.