Oauth2 Linkedin Laravel Package

Product Decisions This Supports

• "Sign in with LinkedIn" as an acquisition and activation lever. This package is the plumbing behind a LinkedIn OAuth button: it lets a Laravel/PHP app redirect a user to LinkedIn, handle the callback, exchange the code for a token, and pull a basic profile. That maps directly to onboarding-funnel decisions — removing password creation, pre-filling name/email/headline/photo, and reducing signup drop-off for B2B audiences.
• Profile enrichment at signup, not a growth feature in itself. The realistic value is one-time data capture (verified work email, employer, job title) rather than ongoing LinkedIn Graph access. Decide scope accordingly: "import profile once" is a week of work; "sync connections, post to feed, or read company pages" is a partner-program and API-access conversation this package does not solve.
• Build vs. buy vs. adopt on the identity layer. Three viable paths: (a) adopt this MIT provider, (b) write a ~100–200 line custom provider against league/oauth2-client, or (c) buy a hosted identity vendor (Auth0, Clerk, WorkOS, Supabase Auth) that owns provider churn. This package is the "cheap and self-hosted" corner of that matrix; it's the right call when identity is not a differentiator but a checkbox.
• Roadmap: provider coverage and abstraction. If LinkedIn is the first of several social providers, standardizing on league/oauth2-client plus per-provider adapters creates a repeatable pattern (Google, Microsoft, GitHub, Apple) instead of N bespoke integrations. If LinkedIn is the only provider, that abstraction is over-engineering and Laravel Socialite is the shorter path.
• Prioritization input for a "professional identity" trust signal. A LinkedIn-verified profile can feed ranking, fraud/spam reduction, or marketplace trust badges (recruiting, staffing, B2B marketplaces, sales-intelligence tools). Whether that's worth a sprint is a product bet; this package only lowers the implementation cost of the bet.
• Explicit non-goals. It does not give you LinkedIn marketing APIs, company page management, ad targeting, or "share to LinkedIn." If a stakeholder request sounds like "integrate with LinkedIn," scope it to authentication before committing.

When to Consider This Package

Consider it when:

• You are on PHP/Laravel and already committed to league/oauth2-client — this provider snaps in as one config entry and one class, no new dependency tree.
• You want a self-hosted, MIT-licensed, zero-vendor-fee login path with no data leaving your infrastructure beyond the OAuth handshake.
• Your need is the plain authorization-code flow for basic profile scopes, and you can own the integration and any future patching yourself.
• You value a 20-line integration over a 200-line one and are comfortable vendoring or forking a small class.

Look elsewhere when:

• Maintenance risk is unacceptable. The last release was April 2020. LinkedIn has since migrated to OpenID Connect ("Sign In with LinkedIn using OpenID Connect") and deprecated the legacy r_liteprofile / r_emailaddress scopes. Treat this package as a starting point, not a supported product — verify its endpoints and scope strings against current LinkedIn developer docs before you plan around it.
• You need OIDC semantics (ID token validation, JWKS, standard claims). A generic OIDC client is a better fit than a LinkedIn-specific legacy provider.
• You are a standard Laravel app. laravel/socialite is the idiomatic route and already covers social login with Laravel conventions; adding league/oauth2-client underneath Socialite is redundant unless you need the lower-level abstraction for multiple providers.
• Compliance or security review gates on dependency health. Stale, low-maintenance auth code is a recurring audit finding. If you have a supported-dependency policy, this fails it on paper regardless of whether the code works.
• You need enterprise SSO, SCIM, or multi-tenant identity. Those are buy decisions; this package is a login button.

How to Pitch It (Stakeholders)

To executives (30 seconds): This is a small, free, MIT-licensed adapter that lets our Laravel app add "Sign in with LinkedIn" in days rather than weeks. It's low-cost and low-commitment — no vendor contract, no per-login fees, no user data routed through a third party. It is not a strategic platform bet: the library hasn't been updated since 2020 and LinkedIn has changed its authentication APIs since then, so we should treat it as a head start we own and maintain, not a supported product. Recommendation: fund a one-day technical spike, and decide based on whether the current LinkedIn endpoints still work as-is.

To engineering: It's a thin provider class for league/oauth2-client — URL construction, token exchange, and a resource-owner mapping. Minimal surface, no exotic dependencies, trivial to fork and vendor if upstream stays quiet. The real work is not the library: it's verifying current LinkedIn scopes and the userinfo endpoint post-OIDC migration, handling the case where LinkedIn returns no email, and deciding account-linking behavior for users who already signed up with a password. Estimate accordingly — library integration ~1 day, the surrounding product work ~2–5 days.

To security/compliance: Flag the dependency age up front. It's MIT, it's small enough to audit in an afternoon, and we can pin or vendor it. The auth code path itself is standard OAuth 2.0 authorization code flow; the risk is drift in LinkedIn's API contract, not malicious code.

To the business sponsor: The measurable ask is signup conversion and profile completeness, not "LinkedIn integration." Instrument both before and after; if LinkedIn login doesn't move activation for a B2B audience, the correct decision is to remove the button — not to keep maintaining a stale dependency.