Connect your client

Authentication & scopes

How the Linkeddit connector authenticates over OAuth 2.1 and what each scope grants.

OAuth 2.1 — no API keys

The connector authenticates with OAuth 2.1 bearer tokens only. There are no API keys or custom headers to configure. Your MCP client discovers how to authenticate from the connector's protected-resource metadata and runs the standard authorization-code + PKCE flow in your browser.

Protected-resource metadata is published at https://mcp.linkeddit.com/.well-known/oauth-protected-resource, pointing to the authorization server.
The authorization server is the Linkeddit app itself (linkeddit.com) — you sign in with your normal Linkeddit account.
Tokens are audience-bound to https://mcp.linkeddit.com/mcp; a token minted for anything else is rejected.
Client registration is pre-registration, not dynamic (RFC 7591). Clients that can auto-register do so transparently; clients that can't (Claude.ai) must be given the public Client ID linkeddit-mcp-claude — there is no client secret (PKCE only).

Connect to the URL exactly — mcp.linkeddit.com/mcp, with no trailing slash. The service handles the request without a redirect so POST bodies are preserved.

OAuth Client ID (Claude.ai and other clients)

Linkeddit does not support automatic (dynamic) client registration, so any client that can't self-register needs a pre-registered Client ID. It is a public, PKCE-only client — there is no client secret.

linkeddit-mcp-claudetext

Claude.ai will say "Automatic client registration isn't supported by linkeddit. Edit the connector and add an OAuth Client ID." That is expected — edit the connector, set the OAuth Client ID to linkeddit-mcp-claude, and leave the Client Secret blank. Clients that register automatically skip this step.

Scopes

Scopes gate what an assistant can do with each tool. You don't set them by hand: when you authorize on the Compete plan, your token is granted the full set below, so there is nothing to configure.

Scope	Grants
answer:read	Read Answer Radar projects, prompts, gaps, and audit runs
answer:write	Create/configure Answer Radar projects, update prompts, draft and save fixes
answer:run	Propose prompts and start/launch audits (these incur spend)
reddit:read	Reddit search, subreddit fetch, comments, raw JSON, and subreddit suggestions
leads:read	Search leads; read profiles, posts, comments, insights, pipelines, projects, and stats
leads:write	Create and queue lead-gen pipelines
keywords:read	Keyword autocomplete, SERP research, and your keyword jobs and results
compete:read	Competitor briefs, weekly briefs, switching signals, monitors, and page changes
content:read	Read generated content topics
content:write	Generate content topics and draft outreach DMs

Read scopes (and answer:run) are granted by default at authorize time; write scopes (answer:write, leads:write, content:write) are requested explicitly by your client. Each tool checks its own scope, so a token must carry the scope its tool needs.

Entitlement, idempotency & rate limits

Every connector tool requires the Compete plan; on any other plan calls are refused with not_entitled. Compete unlocks the entire toolset.
Mutating tools take an idempotency_key (1–200 chars). Re-sending the same key replays the prior result instead of doing the work twice.
Requests are rate limited per authenticated user (default 60 per minute). Audits also consume budget — estimate first with answer_audit_estimate.