Sign in

Connect social media account (oauth 2.0)

A user (or Admin acting on a tenant-scoped brand account) connects a social-media account to the CRM via the provider's OAuth 2.0 + PKCE flow so the CRM can read mentions, send messages, and publish posts on their behalf.

When this happens: You go to Settings — Integrations — Social accounts — Connect.

Step by step

  1. 1

    Go to Settings — Integrations — Social accounts.

    Lists the platform's providers with their state (Not Connected / Connected / Needs reconnecting), what each can be used for, and the optional permissions to tick (direct messages, publishing, lead ads).

  2. 2

    Select LinkedIn — Connect.

    EasyCRM generates a single-use anti-CSRF state and, where the provider takes PKCE, a code verifier and challenge; keeps them server-side and redirects to the provider's consent screen with the scopes of the provider's features and the optional permissions the user ticked.

  3. 3

    User signs in and grants consent. Redirects back to /crm/settings/integrations/social/connect?code=…&state=….

    EasyCRM checks state, exchanges the code for access + refresh tokens, encrypts both at rest and keeps them on the user's LinkedIn connection (or the company's brand account). Calls the provider profile endpoint to verify connection. EasyCRM stores ExternalUserId, ExternalHandle, ExternalDisplayName and the picture. EasyCRM shows: Connected as @handle, with what the account can be used for. A brand account that can be listened to is read for its last seven days at its first listening run, so its mentions and comments already appear in the Social inbox (they are tagged and attributed by the rules but do not notify anyone).

Other paths

Connect a tenant brand account

Settings — Integrations — Social accounts — Brand accounts — Add brand account, choosing the provider, the account's name in the CRM and the optional permissions. Same OAuth flow as the main flow, for an account the company holds rather than the Admin; it is visible to every Social CRM user. A company may hold several brand accounts per provider.

Reconnect after token expiry

The background refresh fails three times in a row (refresh token revoked or expired), or a token with no refresh token expires. Sets RequiresReauth. UC-10.1 notification to the owner (for a brand account, its Admins): Your LinkedIn connection (@handle) could not renew its access. Reconnect it in Settings — Integrations to keep using it Open Settings — Integrations — clicks Reconnect — repeats steps 4–7 in place. A brand account must be reconnected with the same account.

If something goes wrong

User denies consent

Returns . EasyCRM shows: Social connection was not authorized. The required scopes are needed for listening and engagement No connection is persisted.

`state` mismatch or csrf

The state in the callback names no connection this user started in this company (unknown, expired or already used). EasyCRM returns HTTP 400, logs a security event.

Provider not active

The provider's platform app is not Active. Its personal card is not shown, with no not available text, unless the you are connected there; then the card offers Disconnect only. In a listening rule an already-chosen network stays visible marked not available (it can be removed, not added again). Not shown unless Active.

Good to know

  • OAuth 2.0 authorization code flow, with PKCE wherever the provider takes it; the implicit flow is not supported.
  • Access/refresh tokens are encrypted at rest using the ABP Data Protection key shared with email tokens (FR-09-001 / FR-13-001).
  • A user may connect at most one account per provider; a tenant may connect multiple brand accounts per provider.
  • All connection actions are recorded in the audit log (SocialConnectionCreated, SocialConnectionRevoked).