[bug][v2] LinkedIn OAuth fails with invalid_client after successful authorization — Cloud and self-hosted #2468

Executor version

2.0.0-beta.32

How do you run Executor?

Self-host (Docker)

Operating system

Linux

Integration involved

LinkedIn, using a personal developer OAuth application

What happened

LinkedIn successfully authenticates the user and returns an authorization code to Executor. However, Executor fails to exchange that code for an access token.

The sanitized error from the browser HAR is:

{
  "_tag": "OAuthCompletionFailed",
  "reason": "invalid_client",
  "cause": {
    "stage": "exchange",
    "status": 401,
    "providerError": "invalid_client"
  },
  "serviceError": {
    "error": "invalid_client",
    "description": "Client authentication failed"
  }
}

The HAR also confirms that Executor sends code_challenge and code_challenge_method=S256 during authorization.

The LinkedIn Client Secret was regenerated, and the connection still failed. The same problem was observed with Executor Cloud, making a local reverse proxy or LAN configuration issue unlikely. Detailed Cloud token-exchange diagnostics have not yet been captured.

What you expected

Executor should exchange the authorization code successfully and establish an authenticated LinkedIn connection using the permissions granted to the application.

Steps to reproduce

1. Create a LinkedIn OAuth app with the OpenID Connect and Share on LinkedIn products.
2. Register Executor's exact OAuth callback URL.
3. Configure the LinkedIn integration in Executor using the app's Client ID and Client Secret.
4. Start the connection, authenticate with LinkedIn and approve the requested permissions.
5. LinkedIn redirects back with an authorization code.
6. Executor fails during token exchange with invalid_client.

Diagnostics / logs

Confirmed failure

Executor self-hosted 2.0.0-beta.32, Firefox 159.0 on Linux, October 31, 2026.

The sanitized browser HAR confirms:

• LinkedIn accepted the authorization request and returned an authorization code.
• The LAN-only HTTPS callback was reachable and returned successfully.
• Executor's OAuth completion operation returned HTTP 400.
• The underlying LinkedIn token exchange returned HTTP 401 invalid_client, with description Client authentication failed.
• The authorization request included code_challenge and code_challenge_method=S256.
• Requested scopes: openid profile email w_member_social.
• Regenerating the LinkedIn Client Secret did not resolve the issue.
• Executor Cloud also fails to connect LinkedIn, although its exact server-side error was not independently captured.

Existing bug and proposed fix

This matches #2087:
#2087

The original issue contains controlled tests showing that LinkedIn accepts the confidential OAuth flow without code_verifier but rejects requests including it with HTTP 401 invalid_client.

A proposed fix already exists in PR #2093:
#2093

That PR omits PKCE for LinkedIn's standard confidential OAuth flow while preserving PKCE for other providers and public clients.

Both the issue and PR were closed during v2 backlog cleanup without a merged fix. The maintainer requested a new report against v2 if still reproducible.

Could this fix be ported to v2?

Additional notes

• Self-hosted deployment: Docker on Kubernetes, behind HTTPS ingress.
• Pod logs did not expose the OAuth failure; the browser HAR contained the actionable error.
• Beta.33 was reviewed but not retested; its published changes do not appear to fix this issue.
• The original HAR is intentionally not attached because it contains session cookies and OAuth credentials.
• All identifiers, credentials, authorization codes, tokens, and private hostnames have been removed from this report.

Before you submit

• I searched the open issues for a duplicate.
• I removed all keys, tokens, and credentials from this report.