LinkedIn Marketing API OAuth refresh fails in headless CI pipeline

Direct answer

Yes. The refresh-token endpoint works in headless CI without preserved session cookies. The call requires only client_id, client_secret, and refresh_token with grant_type=refresh_token; no browser session or user interaction is involved.

Errors to expect

A rejected refresh token returns HTTP 400 with invalid_grant, whether the token is revoked, expired through inactivity, or used outside an interactive session. An expired access token returns HTTP 401 with invalid_token. Campaign-management calls made without the r_rlp scope return HTTP 403 Forbidden.

Confirmed behavior and assumptions

Item	Status	Notes
Refresh grant needs no cookies	Confirmed	OAuth 2.0 refresh grant; client credentials only.
Rejected refresh token	Confirmed	HTTP 400 invalid_grant.
Expired access token	Confirmed	HTTP 401 invalid_token.
Missing r_rlp scope	Confirmed	HTTP 403 on campaign-management endpoints.
Refresh-token rotation	Unverified	Check current LinkedIn docs; do not assume a new refresh token is issued.
Exact scope set per endpoint	Unverified	Some organization endpoints may require r_organization_admin.

Pipeline steps

1. Store the refresh token in a CI secret store; never commit it.
2. Before campaign-management requests, exchange the refresh token for a new access token.
3. Inspect the token response and confirm the scope includes r_rlp.
4. On HTTP 400 invalid_grant, stop and trigger a full interactive re-authorization; do not retry the refresh blindly.
5. If you retry transient token-endpoint failures, use exponential backoff.

Verification command

curl -X POST https://www.linkedin.com/oauth/v2/accessToken \
  -d grant_type=refresh_token \
  -d refresh_token="$LINKEDIN_REFRESH_TOKEN" \
  -d client_id="$LINKEDIN_CLIENT_ID" \
  -d client_secret="$LINKEDIN_CLIENT_SECRET"

Log the raw JSON and confirm a new access_token is present. Compare the scope value against r_rlp before calling campaign-management endpoints. Verify current error codes and token lifetimes in LinkedIn's developer docs before production use.

Missing diagnostic detail

What HTTP status and error code does the pipeline currently receive when refresh fails? A 400 invalid_grant means the refresh token itself is invalid and requires re-authorization; a 401 invalid_token means only the access token expired and a refresh should succeed.