LinkedIn OAuth2 Token Refresh and Rotation

LinkedIn access tokens expire, and every automation built on one stops when it does. This blueprint runs io.kestra.plugin.linkedin.OAuth2 on a monthly schedule to exchange a long-lived refresh token for a fresh access token. The task returns accessToken, tokenType, expiresIn, expiresAt, and scope as outputs, and the flow confirms each rotation in Slack using only the non-sensitive scalars.

How it works

1. refresh_token (io.kestra.plugin.linkedin.OAuth2) posts the client ID, client secret, and refresh token to LinkedIn's token endpoint and returns the new credentials as task outputs.
2. Within the same execution, downstream tasks can consume the fresh token directly as {{ outputs.refresh_token.accessToken }}, no storage step required.
3. confirm posts the token type, granted scope, and expiry to Slack. The token value itself is deliberately kept out of the message.
4. The errors block sends a distinct Slack alert when the exchange fails, the usual cause is a revoked or expired refresh token.
5. A disabled-by-default Schedule trigger rotates the token on the first of every month.

What you get

• A fresh LinkedIn access token on a fixed cadence instead of a surprise expiry.
• expiresIn and expiresAt outputs so the team always knows the token's remaining lifetime.
• A Slack confirmation trail for every rotation and an alert the moment a refresh token dies.
• A pattern where downstream LinkedIn tasks chain off {{ outputs.refresh_token.accessToken }} in the same flow.

Who it's for

• Marketing operations teams running LinkedIn analytics or engagement flows that must not stop on an expired token.
• Platform teams standardizing credential rotation across integrations.
• Anyone who has debugged a silent LinkedIn 401 two months after setup.

Why orchestrate this with Kestra

Token rotation is exactly the kind of small, critical chore that gets forgotten. Kestra gives it a schedule, keeps the client secret and refresh token in namespace secrets, records every rotation in the execution history, and raises a Slack alert the one time it fails.

Prerequisites

• A LinkedIn Developer application with the client ID and client secret.
• A refresh token obtained during the initial member authorization flow (LinkedIn refresh tokens last up to a year while access tokens last about 60 days).
• A Slack incoming webhook for confirmations and alerts.

Secrets

• LINKEDIN_CLIENT_ID: OAuth2 client ID from the LinkedIn Developer Portal.
• LINKEDIN_CLIENT_SECRET: OAuth2 client secret from the LinkedIn Developer Portal.
• LINKEDIN_REFRESH_TOKEN: refresh token from the initial authorization flow.
• SLACK_WEBHOOK_URL: Slack incoming webhook URL.

Quick start

1. Add the four secrets to your Kestra namespace.
2. Execute the flow and check the Slack message reports the token type, scope, and expiry.
3. Set disabled: false on the monthly trigger.

How to extend

• Persist the fresh token for other flows by adding io.kestra.plugin.core.kv.Set after the exchange, then read it elsewhere with the kv() function.
• On Kestra Enterprise Edition, rotate the LINKEDIN_ACCESS_TOKEN secret itself through the secrets API so every existing flow picks up the new value transparently.
• Chain io.kestra.plugin.linkedin.GetPostAnalytics directly after the exchange with accessToken: "{{ outputs.refresh_token.accessToken }}" so analytics always run on a token minted seconds earlier.
• Alert earlier by scheduling weekly and comparing expiresIn against a threshold in a follow-up task.

Links

• LinkedIn plugin documentation
• LinkedIn OAuth2 refresh token documentation