Troubleshooting LinkedIn OAuth with Self-Hosted n8n: Resolving 'Unauthorized' After Consent
When connecting LinkedIn to a self-hosted n8n instance, an 'Unauthorized' page after approving the app usually indicates an OAuth redirect or configuration mismatch rather than a LinkedIn outage. Diagnose redirect URIs, BASE_URL/public access, and headers; implement secure public endpoints or a trusted proxy and validate scopes to resolve the issue.
Typical failure mode
The symptom-LinkedIn opens the auth page, you approve, and then see an "Error: Unauthorized"-is symptomatic of the OAuth callback failing to validate or reach n8n. Common root causes are mismatched redirect URIs, the self-hosted instance not being reachable at the registered public URL, or missing/incorrect headers introduced by proxies and ingress controllers.
Technical checklist to diagnose
1. Verify the Redirect URI registered in LinkedIn exactly matches n8n's public callback (including protocol, host, port, and trailing slash).
2. Ensure n8n's BASE_URL (or equivalent env var) is set to the public address LinkedIn calls back to.
3. If behind a reverse proxy or TLS terminator, confirm Host and X-Forwarded-For/Proto headers are passed through and n8n is configured to trust them.
4. Confirm client id/secret are correct and that the app has the required LinkedIn scopes and is in a state that allows the grant (some LinkedIn APIs require app review).
Logging and experiments
Enable verbose n8n logs and inspect the callback request. Use curl or a temporary public endpoint (e.g., ngrok) to replicate the redirect and see whether LinkedIn receives an HTTP 200 or 4xx. Check for mismatched state parameters or CSRF rejections in log traces.
Recommended fixes and operational advice
If you run n8n in production, adopt a stable public domain with proper TLS and ensure the OAuth app points there. For development, use a trusted tunneling service. Add monitoring around auth flows and automate validation of redirect URIs when deploying. For enterprises, place n8n behind an authenticated gateway and store OAuth secrets in a vault so rotation and auditing are straightforward.
Original Source
n8n Community