LinkupAPI sells a LinkedIn automation API: send connection requests, message threads, comment on posts, read the inbox and search people, as plain HTTP calls on a LinkedIn account your user connects. Your product or AI agent decides who, what and when. The API executes and returns JSON, over REST or an MCP server.
The same key also covers email, WhatsApp and iMessage, but LinkedIn is the core product and the part with the real risk. The company is LINKUPAPI SAS, registered in Paris.
This note covers what the LinkedIn API does, how it works, and what can go wrong. The 2 sources are the LinkedIn automation API page and the vendor's LinkedIn API integration guide. Both are marketing, so the risk section reads them critically.
What the LinkedIn API does
Actions: connection requests with a note, messages, comments, inbox and conversations, connection lists, people and company search, profile and company data, Sales Navigator and Recruiter. The page counts "+100 ready to use automated actions", including email finding, hiring and funding signals, and job postings.
The 3 workflows the vendor shows:
| Buyer | Workflow |
|---|---|
| Sales platform | Invite with a note, message once accepted, hand the thread to a human on the first reply |
| ATS | People search by title, company and seniority, invite, follow up with the job link |
| AI agent | Over MCP: read the profile, write the note, invite, comment on a post, follow up by email |
Pacing: up to 150 connection requests per week per account, paced by LinkupAPI. Past that, the API returns a limit error instead of forcing the send.
Replies: 1 webhook gets accepted invitations, new messages and bounces in real time, with retries and a delivery log. You can poll the inbox endpoints instead.
How it works
The integration guide splits "LinkedIn API" into 3 routes. The split is useful, whoever wrote it:
| Route | What it's for | Auth | Can send? |
|---|---|---|---|
| Official LinkedIn API | Sign-in, ads, Pages, your own posts | OAuth 2.0, partner review | No |
| Account-based API | Search, invitations, messages, inbox | API key, user connects account | Yes |
| Data API | Read profiles, companies, jobs at scale | API key | No |
The official API has no generally available endpoint to message or invite another member, even for partners. LinkupAPI is the 2nd route: it acts through the user's own authenticated session.
The integration is 3 steps. The user connects their account through a hosted login, which hands a login_token to the /v2/login endpoint. After that, every action is a POST with the same body: account_id, action and params.
import requests
BASE = "https://api.linkupapi.com/v2"
HEAD = {"x-api-key": "YOUR_API_KEY"}
# 1. Invite with a personal note
requests.post(f"{BASE}/network", headers=HEAD, json={
"account_id": "YOUR_ACCOUNT_ID",
"action": "invite",
"params": {"profile_url": "https://www.linkedin.com/in/johndoe",
"message": "Hi John, we both work on B2B sales tooling."},
})
# 2. When the webhook reports the acceptance, send the first message
requests.post(f"{BASE}/messages", headers=HEAD, json={
"account_id": "YOUR_ACCOUNT_ID",
"action": "send",
"params": {"profile_url": "https://www.linkedin.com/in/johndoe",
"message_text": "Thanks for connecting, John."},
})
To keep the session looking like a person, the service gives each account:
- A dedicated proxy: a residential or ISP IP near the account's real location, never shared.
- A fixed device signature, replayed on every request.
- Server-side calls only: no browser extension on the user's machine.
- Health monitoring with alerts when LinkedIn flags an account, instead of fixed daily caps.
Pricing
Per connected account, with unlimited invitations and messages (USD, excluding VAT, November 2026):
| Connected accounts | Price |
|---|---|
| Up to 10 | $55 a month, flat |
| 11 to 50 | $5.50 per account |
| 51 to 200 | $5.00 per account |
| 201 to 640 | $4.50 per account |
| Unlimited | $3,000 a month, flat |
The cap is the pitch: a product where 2,000 customers connect their own seats still pays $3,000. Extra accounts are billed at the end of the cycle on the peak connected at the same time.
Risk analysis
The short version: the technology is good, and the risk sits almost entirely with whoever owns the connected LinkedIn account.
1. It works around LinkedIn's rules, not within them
The vendor's own guide makes the case. The official API "cannot send connection requests or messages to other members, even after partner approval". The account-based route exists because LinkedIn doesn't allow it. LinkedIn's User Agreement (section 8.2, the "Don'ts") bans bots and automated methods to access LinkedIn, third-party software that automates activity, and automated invitations and messages.
The guide says an account-based API is "not a browser automation tool" because it sends requests instead of replaying clicks. That's a technical difference, not a contractual one: the User Agreement bans automated activity, whatever the transport. Neither page claims LinkedIn has approved the service.
2. The ban lands on the account owner
LinkupAPI's terms of use make the customer responsible for the accounts they connect. LinkedIn's help pages describe the ladder: invitation limits that block sending for about a week, temporary restrictions for automation, and permanent restriction after repeated offences.
- Pacing is the vendor's number, not LinkedIn's. LinkedIn doesn't publish a weekly invitation limit. 150 a week is LinkupAPI's pace, and LinkedIn can change its threshold without notice.
- "Alerts, not caps" moves the decision to you. The service tells you when an account is flagged. By then, the damage has started.
- The account is the asset. For a seller, a LinkedIn profile holds years of network and reputation. $5.50 a month buys the automation, not insurance for that.
3. The anti-detection layer cuts both ways
Dedicated residential IPs and a replayed device signature exist so LinkedIn can't tell the traffic from a person. That keeps accounts alive day to day. It also means the design is evasion, and if LinkedIn detects it, it looks like deliberate circumvention, not an innocent tool.
4. Session custody
"Passwords never stored" is true and narrow. To act on the account, LinkupAPI must hold a live session, which is as good as the password: it opens the inbox, the network and every message. The automation page also claims a "zero-storage architecture" and "zero data retention", while the home page says sessions are "encrypted, isolated per account and revocable". A session has to be stored to be revoked, so read "zero storage" as marketing.
If LinkupAPI is breached, every connected account is exposed at once. Revoking the session, and logging out of other sessions in LinkedIn's settings, is the kill switch.
5. Vendor and platform risk
LinkedIn sues. It sued Proxycurl in January 2025, and Proxycurl shut down in July 2025. It sued ProAPIs in October 2025 over fake-account scraping. Both were data scrapers with fake accounts, not session APIs on real accounts, so they're a different case. They still show the risk: a provider can disappear, and a product built on it goes with it. LinkedIn can also change its internal interfaces at any time, and every account-based API breaks until the vendor catches up.
6. Data protection
The terms make the customer the GDPR controller and LinkupAPI the processor. Cold-messaging EU prospects needs your own legal basis, usually legitimate interest, with an opt-out. Search results, profiles and replies are personal data, and EU hosting doesn't change who is responsible for them.
7. An AI agent with send rights
The MCP server gives an agent the power to invite, message and comment as you. The vendor says "you set the rules and approve the batch; the agent handles the volume". 2 risks the pages don't mention:
- Prompt injection. The agent reads profiles and posts that strangers wrote. A crafted "About" section can try to steer it, and the agent has send rights on a real account.
- Reputation. An agent commenting on posts at scale writes under your name. A bad comment is public and permanent.
Keep a human approval step on every send, and never give the agent comment rights.
Risk summary
| Risk | Likelihood | Impact | Mitigation |
|---|---|---|---|
| Account restricted | Medium | High | Low volume, personal notes, stop on reply, never your main account |
| Permanent ban | Low-medium | Very high | Back off on the 1st flag, never repeat after a restriction |
| Session breach at vendor | Low | Very high | Revoke sessions, review active sessions in LinkedIn settings |
| Vendor shut down or broken | Medium | Medium | Keep the outreach logic yours, keep a manual fallback |
| GDPR complaint | Low | Medium | Legal basis, opt-out line, data minimisation |
| Agent misbehaviour | Medium | High | Human approval per batch, no comments, no auto-reply |
Who it fits
- A good fit: a sales tool, ATS or AI SDR product whose customers knowingly connect their own accounts and accept the risk. The per-account cap makes the economics work.
- A poor fit: your own LinkedIn account, if it's your main professional asset. Also any team that can't absorb an account loss.
Alternatives
The vendor's own comparison, which favours itself:
| Product | Built for | Pricing | Agent access |
|---|---|---|---|
| LinkupAPI | Products and AI agents | Per account, $3,000 cap | MCP, REST |
| Unipile | Products | Per account | REST |
| Linked API | Developers | Per seat | REST |
| HeyReach | Agencies running campaigns | Per sender seat | Campaign UI |
All 4 act through real LinkedIn accounts, so the risk analysis applies to each.
My take
LinkupAPI is a clean design: 1 call shape, 1 webhook, an MCP server and a price that stops growing. If I were building an outreach product for other people, this is the layer I wouldn't want to build.
For my own work, the risk outweighs the convenience. Every LinkedIn action runs on a personal account, the ban risk stays with the owner, and the session sits on someone else's server. I keep my LinkedIn account away from any automation: in my own outreach engine, the LinkedIn steps stay manual, see Prospectee: my outreach engine, from 1 line to a campaign.
The email side is the safer part: finder, verifier and sending from a real Gmail or Outlook mailbox, with replies and bounces on the same webhook.
Further reading
The 2 sources of this note:
Who carries the responsibility:
LinkedIn's legal campaign against scrapers:
