Automate LinkedIn with ChatGPT

Yes, ChatGPT can send a LinkedIn connection request or message for you, through a custom MCP server that holds a LinkedIn account you own. Your plan decides whether it can: OpenAI gives full MCP with write actions to Business, Enterprise and Edu workspaces on ChatGPT web, and lets Pro connect a server for reading only. Once it can, each send clears the server’s preview and confirm, with ChatGPT’s own approval card on top.

Below: the plan table, the Plugins steps, what the sign-in does in the background, how one invitation travels from your prompt to LinkedIn, and the API key route for runs outside the chat window. Every example uses our server, GTM API at https://mcp.gtm-api.com/mcp, with 190+ typed LinkedIn tools behind three discovery tools.

Which ChatGPT plan can send

OpenAI settles this before any server gets a say. Its help page on custom MCP servers, updated 14 October 2026: “Custom MCP server connections and full MCP support are available for ChatGPT Business and Enterprise/Edu customers on ChatGPT web.” The same page’s FAQ gives Pro its answer, “Pro users can connect custom MCP servers with read/fetch permissions”, names no other plan, and rules out mobile in three words: “No – web only.”

On the workspace plans the first yes belongs to an admin. On Business, “Only admins and owners can create and publish plugins for custom MCP servers for a Business workspace.” On Enterprise the permission behind it, Create plugins with MCPs, is “Off by default for Enterprise” until an admin grants it by role. Ask before you build anything around it.

Pro has a second catch on our endpoint. The tool that runs every LinkedIn call, call_tool, declares itself a write (readOnlyHint: false) because the same tool sends, and OpenAI says annotations “help ChatGPT and Codex choose appropriate confirmation and safety behavior”. A plan held to read and fetch should expect to list the catalogue and go no further, which makes Pro the wrong plan for this job.

What ChatGPT connects to

Nothing in ChatGPT talks to LinkedIn directly. LinkedIn’s Messages and Invitations APIs are open to approved partners only (the LinkedIn messaging API page has the detail, how to get LinkedIn API access the wider picture), so a connector reaches something that holds the account. That something comes in three shapes, ours first.

• Ours, gtm-api.com: an account-based API with a hosted MCP server. Your own LinkedIn account runs in its own cloud browser with its own proxy, and each capability is a typed tool behind a remote endpoint that ChatGPT adds by URL.
• A browser extension. It acts inside your own Chrome session and stops when that browser or that computer does.
• A general automation platform. n8n holds a LinkedIn connection and fires from a trigger, with the ceilings set out on the n8n LinkedIn node page.

For ChatGPT the deciding question is whether the service publishes a remote MCP endpoint that signs in with OAuth. The sign-in section explains why the OAuth half carries the weight.

Adding the server in ChatGPT

Custom servers now live under Plugins, and OpenAI’s page of 14 October 2026 drops the step older guides open with: “You don’t need to turn on Developer Mode first.” The path, from OpenAI’s guide to connecting and testing a server, with our values filled in:

1. Open Plugins. On ChatGPT web, from the sidebar.
2. Add a custom server. Select the plus button, then Add custom MCP server.
3. Name it. gtm-api will do, and the description is optional.
4. Paste the endpoint. Under Connection, enter https://mcp.gtm-api.com/mcp, path included.
5. Choose OAuth. The server publishes its own sign-in metadata, so there is no client ID, secret or key to type.
6. Accept the warning. Read it, then select I understand and want to continue.
7. Create it. Select Create as a plugin, approve GTM API’s consent screen, and review the tools ChatGPT found.

Then install the plugin, start a new chat, type @ and pick it. Selection is per message (“App selection applies to the message where you use it, not the entire conversation”), so mention the plugin again when a later message needs LinkedIn. Workspaces still on the older Apps page use Apps, Create and then Scan Tools, which runs the OAuth prompt before the scan finishes. For other clients, the LinkedIn MCP config generator prints the exact steps.

How ChatGPT signs in without a key

ChatGPT discovers the whole sign-in from one refusal. Its first call comes back 401 with a header naming the server’s metadata, and every later step is ChatGPT following links.

• The resource names its sign-in server. The protected-resource metadata, defined in RFC 9728, points at https://app.gtm-api.com/id/v4.
• ChatGPT registers itself. That server publishes a registration_endpoint, RFC 7591 dynamic client registration. OpenAI prefers Client ID Metadata Documents where offered and notes that “Dynamic client registration remains supported when configured”, the route ours takes.
• PKCE with no secret to store. S256 is the only code challenge method and none the token endpoint auth method, the shape of a public client.
• A refresh token on every exchange. OpenAI asks servers to advertise offline_access, warning that without it “ChatGPT may lose access after the original authorization expires”. Ours issues a refresh token on every code exchange whether or not the scope is requested.

{
  "issuer": "https://app.gtm-api.com/id/v4",
  "registration_endpoint": "https://app.gtm-api.com/id/v4/oauth/register",
  "grant_types_supported": ["authorization_code", "refresh_token",
    "urn:ietf:params:oauth:grant-type:token-exchange"],
  "code_challenge_methods_supported": ["S256"],
  "token_endpoint_auth_methods_supported": ["none"]
}

A key has no place in this flow. OpenAI’s authentication guide says ChatGPT does not support machine-to-machine grants, “nor can it present custom API keys”. A LinkedIn server that accepts only a key header cannot be added in ChatGPT at all, which makes it the first thing to check on any server you are weighing.

The consent screen is where permissions are set. You tick the workspace the connection acts in and see the scopes ChatGPT asked for, per domain and per direction: can_view_linkedin_messages reads the inbox, can_act_linkedin_messages sends, can_act_linkedin_connections invites. The token gets what the client asked for, cut down to what your own role in that workspace holds, so a connection made by a member whose role cannot send will never send, whatever the model is told.

How one invitation reaches LinkedIn

Ask ChatGPT to invite one person and four tool calls happen, two of which can put an approval card in front of you.

1. It finds the tool. The two discovery tools are declared read-only, so they run without a card on any setting short of Always ask.
2. It asks for a preview. call_tool runs send_linkedin_connection_request without a commit_token. The server validates the arguments first, so a note past the account’s limit (200 characters, 300 on Premium) fails here, and returns a preview with a single-use token. Nothing has reached LinkedIn, but ChatGPT counts the call as a write and can show a card for it.
3. It confirms. The same arguments again, plus the token. This is the card that sends.
4. The budget decides. The account’s daily invitation budget is checked before dispatch. When it is spent, the server answers with the time the call can run again and nothing goes out, and a send that does go out reports what is left for today.

{
  "preview": true,
  "tool": "send_linkedin_connection_request",
  "dangerous": true,
  "arguments": {
    "linkedin_account_sid": "ln_ac_xxxxxxxxxxxx",
    "public_identifier": "prospect-slug",
    "note": "Saw your talk on onboarding metrics. Worth a chat?"
  },
  "validated": true,
  "commit_token": "eyJ2IjoxLCJ0b29s...",
  "expires_in_seconds": 300
}

Tell the two cards apart by the commit_token: the preview’s arguments have none, the send’s do. The token is bound to that tool and those exact arguments, works once and expires in five minutes. Edit the note in between and the server answers “The arguments changed since the preview”, so what you approved is what goes out.

On OpenAI’s side, the developer documentation says “ChatGPT currently requires manual confirmation in any conversation before write actions can be taken.” The help center adds four settings, from Always ask to Allow all actions, lists “Sending an email, message, comment, or invitation” among the actions that may need extra review, and keeps managed workspaces strict: “Always allow is not offered as a persistent permission to managed-workspace members”.

So ChatGPT’s card is the human check, and how often it appears depends on settings and workspace policy. The server’s preview sits under whatever ChatGPT decides: a send always takes two deliberate calls with identical arguments, and the budget holds when nobody is watching the chat.

Runs outside the chat: the API key

ChatGPT’s scheduled tasks can use connected apps, and OpenAI says an action that sends a message “may require approval. If approval is required, the task pauses until you review it.” A recurring LinkedIn job belongs in code: a script, a worker, or an agent built on OpenAI’s API.

Those runs sign in with a key. The gtm_live_ key that authenticates the REST API works on the MCP server as a plain bearer token, minted in the app under Settings, API keys, scoped to its workspace and permission set, and revocable there. With a key attached, the OAuth flow never starts.

• Clients that take a header send Authorization: Bearer gtm_live_... to https://mcp.gtm-api.com/mcp.
• Clients that only spawn a command run the @gtm-api/linkedin-mcp launcher with the key in GTM_API_KEY, from version 1.3.0. Pins at 1.1.0 or older fail on the first call, and 1.2.x ignores the key.
• OpenAI’s Responses API attaches a remote MCP server from code: its mcp tool takes the server URL, an access token in the authorization field, and require_approval, which decides whether a call comes back to your code for a yes first.

The config generator fills your key into the block or command for each client, inside the browser tab. With nobody in the loop, both remaining controls belong to the server: your code must answer the preview with a second deliberate call, and the daily budgets are checked before every dispatch. How far to trust an unattended agent with an account is the subject of LinkedIn AI agent.

What OpenAI asks you to check

OpenAI’s developer documentation opens its safety advice with “We recommend that you do not connect to a custom MCP server unless you know and trust the underlying application.” The next warning is the one for LinkedIn: “Do not use a MCP if it could contain malicious or untrusted user input, even if you trust the developer of the MCP.” Anyone who can message the account can put text in front of the model, so an inbox is that input by definition, on this server as on any other.

The answer is to shrink what an injected instruction could achieve: a role that holds only what the job needs, sends behind both confirmations, and a budget that caps the worst case. OpenAI also lists what a server should do on its own side, since annotations “do not replace authorization, validation, or confirmation in your server”. Here is where each item sits on ours.

The account underneath

Everything above concerns the client. What stops a run is the LinkedIn account doing the sending: its daily budgets, its age and its recent history apply the same whether a person, a script or ChatGPT made the call. The numbers are on LinkedIn limits, the Claude version of this setup is connect LinkedIn to Claude, and the general picture sits on the LinkedIn MCP server page.

Trying it costs nothing on our side. The free plan holds one connected account with no card, the full API and MCP surface, and daily caps such as 5 connection requests and 10 messages. Past it, billing is per connected account, from $10/account. The ChatGPT side still needs a Business, Enterprise or Edu workspace before a send can happen.

Frequently Asked Questions

Sources & Further Reading

• OpenAI Help Center, connecting custom MCP servers in ChatGPT, updated 14 October 2026 (plans, Pro, web only, Business admins, the frozen snapshot, refresh tokens) · managing app permissions, updated 2 October 2026 (the four settings, actions that may need review, managed workspaces) · scheduled tasks, updated 2 October 2026 (the pause on approval) · plugins, updated 14 October 2026 (Create plugins with MCPs). Read 15 October 2026.
• OpenAI Developers, connect and test your plugin (the steps) · building MCP servers for plugins and API integrations (manual confirmation, the trust warnings, client registration) · authentication (no custom API keys) · build an MCP server (annotations and server-side security) · MCP servers in the Responses API. Read 15 October 2026.
• IETF, RFC 9728, protected resource metadata · RFC 7591, dynamic client registration
• gtm-api.com, connect a client (OAuth, the headless key, the launcher version) · MCP server overview (meta-tools, preview and confirm, budgets) · authentication · server health (tool counts, read 15 October 2026) · billing and plans (free plan caps) · pricing
• Related: LinkedIn MCP server · Connect LinkedIn to Claude · LinkedIn AI agent · LinkedIn messaging API · LinkedIn limits · LinkedIn MCP config generator · LinkedIn automation: how it works · LinkedIn automation tools ranked

Michael SalamatovGTM engineerRuns the gtm-api.com blog. Covers LinkedIn limits, account health and the API side of outbound.in

Last updated: October 2026 · Definitions and benchmarks verified at time of publication