Safe LinkedIn automation: how LiHelper keeps your account safe

The short answer

Writing, scheduling and publishing posts with LiHelper is as safe as posting by hand, because the post goes to LinkedIn the same way LinkedIn's own partners send it: through the official API with a token LinkedIn issued to you. The analytics sync and the Easy Apply assist on the Pro plan are a different category. They act inside your own browser session, and LinkedIn's User Agreement can treat that as automation, so they carry real risk. LiHelper limits that risk — the sync only reads your own pages, the apply assist stops at the review step, and a daily cap and a circuit breaker sit on the server — but it cannot remove it. LiHelper does not like, comment, follow, connect or message for you at all. Our FAQ and Terms say the same thing.

What runs where

Every feature falls into one of three places: LiHelper's servers, LinkedIn's official API, or your own browser. The table shows which, and exactly what leaves your browser in each case.

No password, no cookie: how you connect

You connect LinkedIn with LinkedIn OAuth: LinkedIn's own login page opens, you approve the scopes, and LinkedIn hands LiHelper an access token for your account. That token is encrypted at rest with Fernet before it is stored, and it is the only LinkedIn credential LiHelper holds. It can publish posts and read the basic profile you approved; it cannot log in as you, read your inbox or change your password. Disconnecting LinkedIn from Settings deletes it.

The alternative many tools use is a session cookie. You paste the cookie from your browser, a server stores it and then browses LinkedIn as you, from a data-centre IP, at any hour. That is the pattern LinkedIn's detection is built to catch, and it is also a plain security problem: whoever holds that cookie holds your account. LiHelper has no field to paste a cookie into, and the extension has no code path that reads one. Your own account password is hashed with Argon2, so even we cannot read it.

Publishing through LinkedIn's official API

Every post LiHelper publishes, whether you approved a draft on Creator or let auto-publishing send it on Pro, goes out through LinkedIn's Share API. That is the same route LinkedIn offers to scheduling tools generally: a documented endpoint, authenticated by your OAuth token, that creates a post on your profile with the text and image you chose. No browser is driven, no button is clicked for you, and the timing is a normal API call at your scheduled slot. If you never switch on the Pro job features, the official API is the only way LiHelper ever writes to LinkedIn on your behalf. See how LiHelper works for the full flow from profile sync to a scheduled post.

What the extension does in your browser

LinkedIn's API does not expose your analytics to third parties, so the numbers on your dashboard come from the LiHelper Connector, a Chrome extension that runs in your own logged-in tab. When you click "Sync everything" it opens your analytics, activity, profile and skills pages, reads impressions, engagements, followers, profile views, per-post stats and your headline and skills, and sends only those values to your account. It requests the storage permission plus access to linkedin.com and the LiHelper API — no tabs permission, no access to other sites, no remote code, and no background activity. The extension page explains every permission in the same words as the Chrome Web Store listing.

On Pro, the same extension can also pre-fill an Easy Apply form from your CV and profile. It stops at the review step and never guesses a screening question: anything it cannot answer from what you gave it is left blank for you, and you are the one who presses Submit. Nothing else in your session is touched: there is no liking, no commenting, no following, and no queue of actions waiting to run. If you want a comment, the composer drafts one from a post you paste in, and you copy it across and post it yourself.

The daily cap and the circuit breaker

The limits live on the server, so a modified extension or a second browser cannot exceed them. The Easy Apply assist will not fill more than 20 applications for an account in a day, whatever daily target you set; the same job is never filled twice; and an application only counts once the extension confirms the form was filled on the page — a failed attempt is not silently retried.

There is also a ban-risk circuit breaker. If the extension detects a LinkedIn block, checkpoint or challenge signal twice within 24 hours, the server refuses to hand out any further apply instructions for that account and tells you to rest it. The pause lifts on its own once the signals age out. You can also switch the assist off yourself at any time from Settings, and it is off until you turn it on, on every plan.

What LiHelper refuses to do

Some things are missing on purpose. If a competitor offers them and LiHelper does not, this is why.

• No engagement pods. LiHelper never enrols you in a group that likes and comments on each other's posts. Pods inflate numbers, get flagged and teach the algorithm nothing about your real audience.

• No mass connection or messaging bots. There is no "send 200 connection requests" button and no auto-DM. LiHelper is a posting and analytics tool, not an outreach tool — if you need outreach automation, this is the wrong product.

• No scraping of other people. The extension reads your own analytics, your own profile and your own posts. It does not read the feed and it does not harvest profiles, emails or connection lists, and the Terms forbid using it to do so.

• No cookie-based login. Some tools ask you to paste a session cookie so a server can act as you. LiHelper never does; a server acting on your cookie from a foreign IP is exactly the pattern that triggers LinkedIn restrictions.

• No background activity. The extension has no timer and no tabs permission. Nothing runs when you close the popup, and auto-publishing on Pro goes through the official API, not your browser.

• No selling or training on your data. Your data is scoped to your account, is not used for advertising profiles and is not used to train our own models. The AI models see your text as context for a draft and nothing more.

Your data, in plain words

LiHelper stores your account details, the posts and drafts you create, the analytics numbers the extension synced, and your encrypted LinkedIn OAuth token. To generate a draft, the relevant text — your headline, skills and the posts of yours that performed best — is sent to the AI provider through OpenRouter (models currently include DeepSeek, OpenAI and Google models) and processed under that provider's terms; no model is trained on it. Payments are handled by Paddle, our Merchant of Record, so we never see your full card number. You can delete drafts and posts in the app, disconnect LinkedIn to remove the token, and email support@lihelper.com to close the account entirely. The Privacy Policy lists every provider and your rights under GDPR and similar laws.

The honest risk

LiHelper is an independent product and is not affiliated with, endorsed by, or sponsored by LinkedIn. We do not claim LinkedIn permits any particular automation, and we do not promise you will never be restricted. What we can say is where each feature runs, what it can and cannot do, and that the defaults are conservative: nothing publishes on your behalf until you switch on auto-publishing, and nothing acts in your session until you click. Compare what each plan enables on the pricing page, and start with posting only if you want zero in-session automation.

Read the full guide: Is LinkedIn automation safe? What gets accounts restricted, and what does not — what LinkedIn's rules actually cover, why cookie-replay bots get caught, and a checklist for judging any tool.

Security FAQ