[Python] LinkedIn OAuth 2.0 returns "invalid_client" despite correct credentials and flow

I'm developing an application (ContentFlow) that integrates with the LinkedIn API v2 to allow users to publish content. I am completely blocked trying to implement the OAuth 2.0 Authorization Code Flow with PKCE. Despite following the official documentation meticulously, my backend consistently receives a 401 Unauthorized response with the error {"error":"invalid_client","error_description":"Client authentication failed"} when trying to exchange the authorization code for an access token. Here is a summary of our setup and the exhaustive debugging steps we have already taken.

Our Setup: Backend: Python 3.12 / FastAPI OAuth Library: Authlib for Python LinkedIn App Products: "Share on LinkedIn" and "Sign In with LinkedIn using OpenID Connect" are both active. Requested Scopes: openid profile email w_member_social Redirect URI: [Aquí tu redirect_uri completa, ej: https://8000-....gitpod.io/api/v1/connections/linkedin/callback]

The Flow We Are Implementing: Authorization Request: My backend successfully generates the authorization URL. The user is correctly redirected to LinkedIn. User Consent: The user logs in and grants all requested permissions. Callback to Backend: LinkedIn correctly redirects the user back to our redirect_uri with a valid code and state parameter. My backend successfully receives this callback and validates the state. Token Exchange (THE FAILING STEP): My backend then makes a POST request to https://www.linkedin.com/oauth/v2/accessToken. This is the request that fails with 401 invalid_client.

I am certain the issue is not a simple configuration mismatch. We have systematically ruled out all common causes:

1. Created a completely new LinkedIn App: The error persists even with a brand new app and fresh credentials, which rules out a corrupted state in the original app.
2. Regenerated Client Secret: We have regenerated the Client Secret multiple times. The value in our .env file is a direct copy-paste from the developer portal.
3. Verified redirect_uri Consistency: Using logs, I've confirmed that the redirect_uri sent in the initial authorization request is identical to the one sent in the final token exchange request. There is no mismatch.
4. Verified Authentication Method: My code uses client_secret_post as specified in the LinkedIn documentation. As a test, I tried client_secret_basic, which resulted in a different error (A required parameter "client_id" is missing), confirming that client_secret_post is the correct and expected method.
5. Verified All Parameters: I can confirm my POST request to /accessToken includes grant_type, code, redirect_uri, client_id, client_secret, and code_verifier.

My Question: Given that my implementation correctly follows the OAuth 2.0 flow, and I have validated all credentials and parameters, what could be the potential cause for the persistent invalid_client error? Is there a known issue, an undocumented requirement, or a problem with the API platform itself that could be causing this? I have exhausted all debugging possibilities on my end. Thank you for any insights you can provide.

Continue reading...