LinkedIn Profile Lookup: LinkedIn Profile Scraper, No Cookies

Paste a list of LinkedIn profile URLs and get back a spreadsheet: who each person is, where they work, and what their job title is today.

Who uses this

• Sales and SDR teams with a column of LinkedIn URLs in the CRM, who need name, title and company filled in before writing the first line of an email.
• Recruiters checking whether a shortlist of 200 candidates still holds the job their notes say they do.
• RevOps and data teams piping rows into Google Sheets, Clay or n8n so a lead record is complete the moment it lands.

Try it in 30 seconds

The input box is already filled in with two real public profiles. Click Start and you get one row per person, with the columns below. No login, no cookies, no li_at session token to paste in.

Example output

Real rows from a recent run:

fullName	currentTitle	currentCompany	location	followers
Bill Gates	Co-chair	Gates Foundation	Seattle, Washington, United States	40,689,855
Reid Hoffman	Co-Founder, Executive Board Chair	Manas AI	United States	2,794,979
Satya Nadella	Chairman and CEO	Microsoft	Redmond, Washington, United States	12,195,120

Every row also carries job history with start and end years, schools, connection count, the profile photo, and an optional work email guess.

What it costs

About $8 per 1,000 profiles found. A profile that can't be read is free, so a list with dead or renamed URLs costs you nothing, and first runs fit inside Apify's free credit.

Give this actor a list of public LinkedIn profile links and it fetches each one the way a signed-out browser does, then hands you a flat row per person: name, headline, location, current job title and company, the current roles the page lists with their start and end years, schools with years, follower and connection counts, and the profile photo. No login. No cookies. No li_at session token to paste in, no account of yours at risk, and nothing read from behind LinkedIn's sign-in wall.

The data comes from the schema.org Person block LinkedIn itself publishes in the page source of every public profile, so a row is the profile's own structured description of itself rather than a guess assembled from scraped text. When LinkedIn decides a request should sign in first, the actor says so in the row's status and charges you nothing.

Who it's for

Recruiters and sourcers who already have a shortlist of profile links and need them as a table instead of forty browser tabs. Sales teams who capture a LinkedIn URL on a form or in a CRM field and want the name, title, company and location filled in behind it before the first email goes out. Founders checking that an inbound lead's title still matches what their CRM said six months ago. And anyone building an agent or a workflow that has a profile link and needs the person behind it in a shape a script can read, without keeping a logged-in LinkedIn session alive somewhere.

If you do not have the profile links yet, this is the wrong tool: it looks up profiles you already name, it does not search LinkedIn for people matching a description.

Why this one

• No cookies, no session token, no account. Every request is the plain public page. You are never asked to hand over a li_at cookie, and no LinkedIn account of yours can be restricted because of a run here.
• Read from LinkedIn's own structured data. The row is built from the schema.org Person block in the page source, not from CSS selectors chasing a design that changes monthly. Field names stay put, which is what an agent or a Clay column needs.
• It tells you when the page was reduced. LinkedIn can answer with a trimmed version of the profile in which job titles and past employers are replaced by rows of asterisks. Those never reach your table: the fields come back empty and the row is flagged masked: true, so you can filter or re-run instead of importing placeholder text into a CRM. See the note under "What you get" for how often that happens, measured rather than guessed.
• A block is a labelled miss, not a silent hole. If LinkedIn asks the request to sign in, the row says status: BLOCKED with a plain explanation and costs nothing. A profile that no longer exists says NOT_FOUND. A company page pasted by mistake says BAD_FORMAT.
• Never charged for a miss. Billing fires only on a row where a real profile came back.
• Residential proxy by default. LinkedIn's sign-in wall is driven by the reputation of the IP asking, so the actor ships with a residential proxy already selected, and retries a blocked request on a fresh address rather than handing you the failure.

What you get

One row per profile you submit. Every row starts with the same five fields, then adds the profile fields you selected in "Which columns do you want?" (all of them by default).

Field	Type	Description
query	text	The profile you submitted, echoed back
found	boolean	true when a public profile was read
status	text	OK on a hit, or NOT_FOUND, BLOCKED, BAD_FORMAT, REQUEST_FAILED on a miss
message	text	Plain-English reason for a miss, present only when found is false
scrapedAt	ISO 8601 datetime	When the page was fetched
profileUrl	link	Canonical profile link, https://www.linkedin.com/in/<public id>
publicId	text	The part of the link after /in/, LinkedIn's stable public identifier
fullName	text	Name as the public page shows it
headline	text	The one-line headline under the name
location	text	Location as shown, e.g. Seattle, Washington, United States
currentTitle	text	Job title of the first current role listed
currentCompany	text	Employer for that role
currentCompanyUrl	link	That employer's LinkedIn company page
experience	array	Current roles the public page lists, each {title, company, companyUrl, location, startDate, endDate}
education	array	Schools the public page lists, each {school, degree, startDate, endDate}
followers	number	Exact follower count, taken from the page's structured data rather than the rounded "41M" the top card prints
connections	text	Connection count as LinkedIn displays it, e.g. 500+, which is why it is text and not a number
profileImageUrl	image	Profile photo on LinkedIn's media CDN
source	text	jsonld when the row came from the page's structured-data block, html when it was assembled from the top card instead
masked	boolean	true when LinkedIn served the reduced page and hid some titles or employers
changed	boolean	Job-change monitor only: true when the company, title or location differs from the previous run; null when monitoring is off
changeType	text	Job-change monitor only: company, title, location, none or first-seen; null when monitoring is off
previousCompany	text	Job-change monitor only: the company the previous run remembered
previousTitle	text	Job-change monitor only: the job title the previous run remembered
monitorFirstSeenAt	ISO 8601 datetime	Job-change monitor only: when this watchlist first looked the profile up
experience1Company ... experience3Start	text	Spreadsheet columns only: company, title and start of the first three listed roles, as plain text
education1School, education1Degree	text	Spreadsheet columns only: the first listed school, as plain text (degree is null, see below)
companyDomain	text	Email guess only: the current employer's website domain, from its public LinkedIn company page
emailGuess	text	Email guess only: the most likely work address, guessed from the company's email pattern, not verified at the mailbox
emailCandidates	array	Email guess only: the top 3 addresses, each {pattern, email, confidence}
emailDomainStatus	text	Email guess only: invalid (no mail route), catch-all (disposable-mail domain) or unknown (real mail route, mailbox not checkable). Never valid
mxProvider	text	Email guess only: google, microsoft or other
mailboxVerified	boolean	Email guess only: always false, because no mailbox is ever contacted

Three honest limits on that table, stated here rather than left for you to discover in the data. education[].degree is null, because the logged-out page does not publish degree or field of study at all. experience covers the roles the public page presents as current; full career history is shown only to signed-in members and is not fetched. And there is no skills column, because no Skills section appeared in any of the fifteen public profile fetches this actor was built and tested against, so offering one would mean shipping a column that is always empty.

The other caveat is masked. LinkedIn decides per request whether to serve the complete profile page or a reduced one, and how often it reduces has changed over time. On 2026-09-08, the day this actor was built, the complete page came back on only four of fifteen fetches. From 2026-09-09 on it stopped reducing: 0 of 228 rows this actor returned through 2026-09-16 were masked, and a dedicated test on 2026-09-16 got the complete page on all 67 residential requests across ten profiles. On a reduced page the name, location, current employer, follower and connection counts, schools and photo still come through; the headline and job titles do not, and the row is flagged masked: true so you can see exactly which rows those are. Today you should expect headline and currentTitle on nearly every row, but LinkedIn can switch back without notice, so filter on masked rather than assuming it never happens.

Run it on a schedule

Turn a one-off list into a standing watchlist: instead of a fresh snapshot every time, each scheduled run tells you which profiles changed company, title or location since the last time you looked.

Set LinkedIn profiles to look up (profileUrls), turn on Flag job changes since the last run (deltaMode: true), and optionally give it a Watchlist name (deltaName) so a second schedule doesn't share its memory.

Schedule it in Apify (Schedules > Create) or trigger it from n8n/Make; the delta state lives in a named key-value store, so every scheduled run reads back exactly where the last one left off. See "Track job changes" below for the full mechanics.

Pricing

$8 per 1,000 profiles, plus a $0.00005 start fee. Misses (found:false) are never charged.

A run of 1,000 profiles costs about $4 if every one comes back, less when some are blocked or gone, and less again on a paid Apify plan. Compare that with a per-seat enrichment platform billing $0.08 to $0.40 per enriched row on top of a licence, or with LinkedIn profile actors listed at $100 per 1,000. Rows that come back found: false, for any reason, are free.

Track job changes

Know the week a candidate, customer champion or prospect moves to a new company.

1. Put the profiles you care about in LinkedIn profiles to look up, one per line.
2. Turn on Flag job changes since the last run. Optionally type a Watchlist name such as champions so a second list never shares its memory.
3. Save the input as a task and add a Schedule, weekly is enough for most teams.
4. Add a webhook on Run succeeded that triggers an n8n or Make workflow, or posts to Slack. The workflow reads the run's dataset, keeps rows where changed is true, and sends fullName, previousCompany, currentCompany and profileUrl.

The first run marks everyone first-seen. After that each row says company, title, location or none. Every profile still comes back, so the same dataset can refresh a Google Sheet in full. LinkedIn sometimes hides job titles on the public page; a hidden value is never reported as a change, so you do not get false alarms. Billing does not change: one charge per profile found.

Spreadsheet export

Get one clean line per person for Google Sheets, Excel, Clay or an n8n table, with no JSON to unpack.

Turn on Spreadsheet columns (one row = one line). Each row then also carries experience1Company, experience1Title and experience1Start, the same for roles 2 and 3, plus education1School and education1Degree, all as plain text. In the Output tab pick the Spreadsheet view, then export as CSV or Excel, or use Apify's Google Sheets integration to append each run to a sheet.

The nested experience and education columns stay available for tools that prefer them. Roles are the ones the public page lists as current, in the order LinkedIn shows them, and education1Degree is empty because the logged-out page does not publish degrees. If a saved task lists its own columns, the spreadsheet columns are added anyway once you tick the box. Combine it with the job-change monitor and a weekly schedule to keep a live contact sheet.

Guess work emails

Turn a LinkedIn profile into a likely work email address, with no extra charge per row.

Turn on Guess each person's work email. For every profile, the actor reads the current employer's public LinkedIn company page for its website, keeps the domain (gatesfoundation.org), checks that the domain can receive mail, and fills emailGuess with the most common company pattern (bill.gates@gatesfoundation.org) plus two alternatives in emailCandidates. Each company page is read once per run, however many of your profiles work there.

Every address is guessed from the company's email pattern, not verified at the mailbox. No mail server is contacted, so mailboxVerified is always false and emailDomainStatus is never valid: unknown means the domain has a real mail route, invalid means nothing can be delivered there (and no guess is given), catch-all means a disposable-mail domain. Confirm an address with a verification tool before you send to it at volume. A current employer that is a school, or a company page with no website or only a social link as its website, leaves the email columns empty. In a test on 2026-09-16, 25 of 25 company pages published a website, and all 25 domains had a mail route; all 6 school pages were blocked. Billing does not change: one charge per profile found.

Use it from Clay, n8n, Make, or an AI agent

This actor runs synchronously over plain HTTP — call it directly from a script, a workflow tool, or an AI agent, no Apify Console needed once you have an API token.

curl "https://api.apify.com/v2/acts/accountable_eel~linkedin-profile-lookup/run-sync-get-dataset-items?token=<YOUR_TOKEN>" \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{"profileUrls":["https://www.linkedin.com/in/williamhgates","satyanadella"]}'

n8n. Add an HTTP Request node: Method POST, URL https://api.apify.com/v2/acts/accountable_eel~linkedin-profile-lookup/run-sync-get-dataset-items?token=<YOUR_TOKEN>, Body Content Type JSON, JSON Body {"profileUrls":["https://www.linkedin.com/in/williamhgates","satyanadella"]} (swap in an expression from an earlier node for a real value).

Clay. Add an "HTTP API" column: Method POST, URL https://api.apify.com/v2/acts/accountable_eel~linkedin-profile-lookup/run-sync-get-dataset-items?token=<YOUR_TOKEN>, Body {"profileUrls":["{{profile}}"]}, mapping the row's profile into the profileUrls array.

MCP. In Claude, Cursor, or any MCP client with the Apify MCP server, ask for "LinkedIn Profile Scraper Without Login or Cookies" — the agent will find and run this actor.

How to use

1. In the Apify Console. Open the actor page and click Start — the profileUrls field is already pre-filled with a working example. Results land in the run's dataset as soon as each item is found.
2. Via the API. Call it directly with a POST request — no Console needed once you have an API token:

   curl "https://api.apify.com/v2/acts/accountable_eel~linkedin-profile-lookup/run-sync-get-dataset-items?token=<YOUR_TOKEN>" \
     -X POST \
     -H "Content-Type: application/json" \
     -d '{"profileUrls":["https://www.linkedin.com/in/williamhgates","satyanadella"]}'
   

3. On a schedule. Save this actor as an Apify Task with the input you want, then add a Schedule (hourly, daily, weekly) so it runs on its own — no server of your own required.

1. Open the Input tab and paste your profile links into "LinkedIn profiles to look up", one per line. A full link, a bare linkedin.com/in/..., or just the identifier after /in/ all work.
2. Leave "Try it first" on for the first run. It stops after 5 profiles so you can see the shape of the output before spending on the whole list.
3. Leave the proxy on residential. It is the default, and it is the single biggest factor in how many of your profiles come back rather than blocked.
4. Keep "Max concurrency" low, 2 to 3, on a long list. Speed here buys blocks, not throughput.
5. Optionally narrow "Which columns do you want?", or use "Only keep rows containing" and "Skip rows containing" to filter by keyword, for example to keep only profiles whose row mentions a city or a job title.
6. Turn "Try it first" off and press Start for the full list.

A bigger list in one run. You don't have to run profiles one at a time — paste a whole shortlist into profileUrls and it processes in one job:

{
  "profileUrls": [
    "https://www.linkedin.com/in/williamhgates",
    "https://www.linkedin.com/in/satyanadella",
    "https://www.linkedin.com/in/reidhoffman",
    "https://www.linkedin.com/in/melindagates",
    "https://www.linkedin.com/in/jeffweiner08",
    "https://www.linkedin.com/in/ariannahuffington",
    "https://www.linkedin.com/in/simonsinek",
    "https://www.linkedin.com/in/brenebrown",
    "https://www.linkedin.com/in/adammgrant",
    "https://www.linkedin.com/in/salliekrawcheck",
    "https://www.linkedin.com/in/rbranson",
    "https://www.linkedin.com/in/garyvaynerchuk",
    "https://www.linkedin.com/in/barackobama",
    "https://www.linkedin.com/in/jenhsunhuang",
    "https://www.linkedin.com/in/bradsmi",
    "https://www.linkedin.com/in/charleslamanna",
    "https://www.linkedin.com/in/michaelabbott",
    "https://www.linkedin.com/in/patmoorhead",
    "https://www.linkedin.com/in/randi-weingarten-05896224",
    "https://www.linkedin.com/in/tony-bates-679227a5",
    "https://www.linkedin.com/in/charlesphillips1",
    "https://www.linkedin.com/in/toufisaliba",
    "https://www.linkedin.com/in/claire-hughes-johnson-7058",
    "https://www.linkedin.com/in/lennyrachitsky",
    "https://www.linkedin.com/in/binoyg"
  ]
}

25 profiles ≈ $0.20 if every one is found (25 × $0.008 per found row, plus the $0.00005 actor start fee) — less for any that come back blocked or missing, since a miss is never charged.

Input

{
  "profileUrls": [
    "https://www.linkedin.com/in/williamhgates",
    "satyanadella"
  ]
}

One profile per line. Paste the full profile link, or just the part after /in/. Accepted formats: https://www.linkedin.com/in/williamhgates, linkedin.com/in/williamhgates, williamhgates.

Output

One row per profile submitted:

query	found	status	profileUrl	publicId	fullName	headline	location	currentTitle	currentCompany	currentCompanyUrl	experience	education	followers	connections	profileImageUrl	source	masked	changed	changeType	previousCompany	previousTitle	monitorFirstSeenAt	experience1Company	experience1Title	experience1Start	experience2Company	experience2Title	experience2Start	experience3Company	experience3Title	experience3Start	education1School	education1Degree	companyDomain	emailGuess	emailCandidates	emailDomainStatus	mxProvider	mailboxVerified	scrapedAt
williamhgates	true	OK	https://www.linkedin.com/in/williamhgates	williamhgates	Bill Gates	Chair, Gates Foundation and Founder, Breakthrough Energy	Seattle, Washington, United States	Co-chair	Gates Foundation	https://www.linkedin.com/company/gates-foundation	[{"title":"Co-chair","company":"Gates Foundation","companyUrl":"https://www.linkedin.com/company/gates-foundation","location":null,"startDate":"2000","endDate":null},{"title":"Founder","company":"B...	[{"school":"Harvard University","degree":null,"startDate":"1973","endDate":"1975"}]	40689855	8	https://media.licdn.com/dms/image/v2/D5603AQF-RYZP55jmXA/profile-displayphoto-shrink_200_200/B56ZRi8g.aGsAY-/0/1736826818802	jsonld	false						<role 1: company>	<role 1: title>	<role 1: start>	<role 2: company>	<role 2: title>	<role 2: start>	<role 3: company>	<role 3: title>	<role 3: start>	<school 1>	<school 1: degree>							2026-10-01T06:00:56.197Z

A profile that could not be read comes back as a row with "found": false, a status, and a message explaining which of the four reasons it was, and is never charged.

Tips

• Run a handful of profiles you know by heart first. It is the fastest way to confirm the fields land where you expect before you point a long list at it.
• Filter on masked: true rather than trusting an empty currentTitle. A masked row is LinkedIn trimming the page for that request, not the member leaving the field blank. If the headline matters to you, treat a masked row as "ask again later", not as "this person has no headline".
• publicId is the join key, not fullName. People change their display name and their headline; the identifier after /in/ is what stays the same.
• A wave of BLOCKED rows means the addresses you are running from are being asked to sign in. Lower "Max concurrency", leave residential proxy on, and re-run the blocked rows later. They cost you nothing the first time.
• Store followers as a number and connections as text. LinkedIn caps the connection display at 500+, so forcing it into a numeric column silently loses the distinction between 500 and 30,000.

vs. alternatives

	What it costs	What you get	Trade-off
This actor (linkedin-profile-lookup)	$0.008 per profile found at the FREE tier, less on paid tiers, $0.00005 actor start, nothing for a miss	One flat row per public profile: name, location, current company, current roles with dates, schools with dates, follower and connection counts, photo, and the headline and job title on the rows LinkedIn serves in full	Public profile pages only. Current roles, not full career history; no degree, field of study or skills, because the logged-out page does not publish them; and the headline and job title are missing whenever LinkedIn reduces the page, flagged by masked. Email guesses are pattern-based, not mailbox-verified. It looks up profiles you name; it does not search for people.
HarvestAPI's LinkedIn profile actors	linkedin-profile-search is listed at $100 per 1,000 profiles	A whole family: profile lookup, people search, company and post coverage, and the category's most-used profile scraper at a 4.77 rating	If you need to find people by criteria rather than look up links you already hold, that is a search product and this is not one.
Clay	$0.08 to $0.40 per enriched row in credits, on top of a seat	A whole enrichment workspace: waterfalls across dozens of providers, plus the table and the sequencing around it	If you want one place that does everything and you are not counting rows, that is Clay. This is one column, priced per column, callable from Clay via its HTTP step.
Doing it yourself	Your time, plus residential proxy spend, plus keeping up with a sign-in wall that moves	The same fields	What this absorbs: the structured-data parsing, the reduced-page detection so asterisks never reach your table, the block-versus-missing-versus-bad-input distinction, and retrying a blocked address instead of failing the row.

Prices for third-party tools are their published list prices as of September 2026 and are not tracked here. Check the vendor before relying on the comparison.

FAQ

Do I need a LinkedIn account, or to paste in a cookie? No. That is the point of this actor. It reads the public profile page exactly as a signed-out browser gets it. You are never asked for credentials, a session cookie or a li_at token, and no account of yours is put at risk by a run.

Why did a row come back with found: false? One of four reasons, and status says which. BLOCKED: LinkedIn asked that request to sign in instead of serving the page. NOT_FOUND: no public profile exists at that address any more, or the member has turned public visibility off. BAD_FORMAT: the input was not a member profile, most often a /company/ page pasted by mistake. REQUEST_FAILED: the request did not complete after retries. None of the four is charged.

What is masked: true? LinkedIn answers some requests with a reduced version of the profile in which job titles and past employers are replaced by rows of asterisks. Rather than pass that through, the actor leaves those fields empty and sets masked: true. Name, location, current employer, follower and connection counts, schools and photo still come through, so the row is worth having. How often it happens is LinkedIn's choice and it changes: on 2026-09-08 most fetches were reduced, and from 2026-09-09 to 2026-09-16 none were (0 of 228 rows). It looks like a per-request decision rather than a property of the profile or of where you run from, so re-running a masked row later is worth a try, and it costs you a second charge for that profile.

Are the email addresses verified? No. emailGuess is guessed from the company's email pattern, not verified at the mailbox. The actor checks that the company domain can receive mail at all and ranks the usual address patterns (first.last, first, firstlast) by how common they are, but it never contacts a mail server, because cloud platforms block the port that would need. mailboxVerified is always false for that reason. Run the guesses through a verification tool before a large send.

Why is education[].degree null? Because the logged-out profile page does not publish it. Degree and field of study are shown to signed-in members only. The field is kept in the row so the output shape never changes between runs, but it is left null rather than filled from a guess.

Why is there no skills column? Because the logged-out page has no Skills section. None of the fifteen public profile fetches this actor was built against carried one, in either version of the page, so a skills column would be empty on every row. It is better to say that here than to ship the column.

Does it return full career history? No. The public page shows the roles a member presents as current, and that is what experience contains. Everything earlier is behind the sign-in wall, and this actor does not go there.

Am I charged for a miss? No. Billing fires only when a real profile was read. Blocked rows, missing profiles and malformed input all produce a row explaining themselves, unless you turn on "Hide rows with no result", and none of them cost anything.

Do I need to configure a proxy? It is already configured. Residential proxy is the shipped default because LinkedIn's sign-in wall keys on the reputation of the address asking. You can change the group in the Advanced section, but lowering it is the most common reason a list comes back mostly blocked.

Is this a live fetch or a stored database? Live. Every run fetches the current page. Nothing is stored between runs, so a member who changed jobs yesterday shows the new one today.

Can an AI agent call this directly? Yes. It is on the Apify MCP server, so an agent in Claude, Cursor or any other MCP client can find and run it by name, and the REST endpoint above works from any script or workflow tool.

Personal data, and your responsibility

This actor reads public LinkedIn profile pages, which are personal data about identifiable people. It reads nothing behind the sign-in wall and it holds nothing between runs: each row is fetched live and written to your own dataset, which only you control.

Whether you may collect, store and use that data is a question about you and your purpose, not about this tool. If you are in the EU or the UK, or your subjects are, the GDPR applies to what you do next: you need a lawful basis, and duties around transparency, retention, and honouring a request to be erased. LinkedIn's own User Agreement also restricts automated collection, and it binds anyone using it under an account. Nothing here is legal advice, and running this actor is not a determination that your use is lawful. That call, and the compliance work behind it, is yours. A guessed work email is personal data too, and sending unsolicited email to one brings its own rules (for example the ePrivacy rules in the EU and the UK, and CAN-SPAM in the US).

Related actors

• LinkedIn Jobs Search Lookup run a public LinkedIn job search by keyword and location and get one row per posting.
• Company Domain Enrichment turn the employer you just found into firmographics: registration, DNS, tech stack, hiring signal.
• Email Pattern Finder take the company domain this actor found and work out that company's email pattern in more depth than the built-in "Guess each person's work email" option here.
• Email Deliverability Check verify the guessed address actually has a working mail route before you send to it.

If this saved you a scrape, a rating on the Store page helps other buyers find it.