AFFAANhandClaude Opus 5
0164c0ff8a
Investigated a "redirect_uri does not match the registered value" error on a second laptop. Traced the code fully rather than assume a bug: _linkedin_redirect_uri() computes one value, the frontend already displays that exact value labeled "Add this callback URL in LinkedIn Developer Portal," and the OAuth start endpoint sends that same value — internally consistent, nothing to fix in application code. Found the real cause instead: two separate LinkedIn login mechanisms exist in this codebase from different points in its history — an old terminal script (scripts/start-linkedin-oauth.ps1, port 44002, via the linkedin-mcp-server npm package) and the current in-app button (port 8088, handled directly by the backend). The LinkedIn Developer Portal app only ever had the old URL registered. Documents both mechanisms side by side so they're never conflated again, and records that this fix is shared across every machine using the same LinkedIn app — unlike Google Cloud credentials, which are per-machine. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2.8 KiB
2.8 KiB
Setting up LinkedIn OAuth
Covers the "Authenticate LinkedIn" button in Agent → MCP, and the exact error it produces when LinkedIn's app settings are out of sync with what MaskanX actually sends.
Two different LinkedIn login mechanisms exist in this codebase
Don't mix them up — they use different callback URLs.
| Terminal script (legacy) | "Authenticate LinkedIn" button (current) | |
|---|---|---|
| How it's run | scripts/start-linkedin-oauth.ps1, by hand |
Click the button in Agent → MCP |
| Callback URL | http://localhost:44002/auth/linkedin/callback |
http://127.0.0.1:8088/api/mcp/linkedin/oauth/callback |
| Who handles the callback | The linkedin-mcp-server npm package's own helper process |
MaskanX's own backend, directly |
If you're using the button in the UI (the normal path), you need the second URL registered — not the first.
One-time setup
- Add
LINKEDIN_CLIENT_IDandLINKEDIN_CLIENT_SECRETin the LinkedIn MCP client settings (Agent → MCP → LinkedIn). - Open the LinkedIn Developer Portal (linkedin.com/developers/apps), select the app matching that Client ID → Auth tab.
- Under Authorized redirect URLs, add:
Adding this doesn't remove any URL already registered — LinkedIn allows more than one.
http://127.0.0.1:8088/api/mcp/linkedin/oauth/callback - Click Update.
- Back in MaskanX, the MCP settings page shows the exact callback URL it
will use, labeled "Add this callback URL in LinkedIn Developer
Portal." If you ever run MaskanX on a different host or port than
127.0.0.1:8088, that label will show a different value — register that one, not the one written above; the computed value always wins. - Click Authenticate LinkedIn.
This is shared, not per-machine
Unlike Google Cloud credentials, a LinkedIn app's registered redirect URLs apply everywhere that Client ID is used. Fix it once here and every computer using the same LinkedIn app is fixed — you don't need to repeat this per laptop, only per LinkedIn app.
Troubleshooting
| You see | What it means | Fix |
|---|---|---|
Bummer, something went wrong. The redirect_uri does not match the registered value |
LinkedIn's authorized redirect URL list doesn't contain the exact URL MaskanX just sent. Check the MCP settings page for the exact value in use — it depends on the host/port MaskanX is running on. | Add that exact URL in the LinkedIn Developer Portal, Auth tab. |
LinkedIn credentials are missing |
LINKEDIN_CLIENT_ID / LINKEDIN_CLIENT_SECRET aren't set for this MCP client. |
Add them in Agent → MCP → LinkedIn. |
Invalid OAuth state |
The login was started in one browser session/tab and completed in another, or it timed out. | Click Authenticate LinkedIn again and complete it in one go. |