LinkedIn Profile & Email Finder — Decision-Makers by Company or Role

This LinkedIn profile and email finder turns a list of companies — or a single role/location query — into a clean list of decision-makers: the person's name, title, company, a direct linkedin.com/in/... profile URL, and (optionally) their verified work email. It works entirely from public Google (and Bing) search snippets — so it never logs into LinkedIn, never opens a profile page, and never touches a cookie. There's nothing of yours to get banned.

It's built for founders, marketers, agencies and sales teams who want to find decision-makers by company domain or by role, without risking a LinkedIn account or fighting Cloudflare.

Why this instead of scraping LinkedIn directly?

Authenticated LinkedIn scrapers log in with your li_at cookie, hammer profile pages, and trip LinkedIn's defences — which is how accounts get rate-limited, challenged, or banned. This actor takes the opposite path. It reads what Google has already indexed about public LinkedIn profiles (site:linkedin.com/in "<company>") and parses the result snippets. That means:

• No login, no account, no li_at cookie — there is nothing of yours to suspend.
• No LinkedIn profile-page fetch — so no Cloudflare wall, no checkpoint, no auth challenge.
• Zero account risk — you can't get your LinkedIn banned by a tool that never signs in.

It's the safe, auth-less way to scrape LinkedIn without login — a LinkedIn profile URL finder that reads public search results, not private pages.

What the LinkedIn Profile Finder does

• Takes a list of companies ({name, domain} objects or plain strings) and/or a free-form query like "marketing director Manchester".
• Searches public results for linkedin.com/in/... profiles, biased toward decision-makers with your roleKeywords (CEO, owner, founder, director by default).
• Parses each result's title into a person name + job title, and confirms the profile actually belongs to your target before keeping it.
• Returns a tidy dataset — one item per person — with the name, title, company, profile URL, and why we matched it.
• Runs through Apify's GOOGLE_SERP proxy by default (no BYO key); falls back to Bing when Google returns nothing.

Who it's for

• B2B founders & marketers who need a named decision-maker at each target account.
• Agencies building prospect lists for client niches by company or by role + location.
• Sales & SDR teams who want LinkedIn profile URLs to enrich a CRM or start outreach.
• Recruiters & researchers finding people by company domain without a Sales Navigator seat.

Input

Field	Type	Default	Description
companies	array	[]	Companies to find decision-makers at. Each item is an object {name, domain} or a plain string (a dotted no-space string like acme.co.uk is treated as a domain, otherwise as a company name).
searchQuery	string	""	Alternative to companies: a role/location query, e.g. "marketing director Manchester". Provide companies, searchQuery, or both.
roleKeywords	array	["CEO","owner","founder","director"]	Bias results toward decision-makers.
maxResultsPerTarget	integer	5	How many profiles to keep per company/query.
maxProfiles	integer	100	Hard cap on total profiles for the whole run (caps your spend).
searchEngine	string	"google"	google or bing. Google is default; the actor falls back to Bing if Google returns nothing.
findEmails	boolean	false	Enrich each company-matched profile with a verified work email using your BYO key (see emailProvider + emailApiKey). Requires a company domain; free-form query results stay null. Off by default.
emailProvider	string	"prospeo"	Which email-finder provider your key is for: prospeo (Prospeo) or hunter (Hunter.io).
emailApiKey	string (secret)	—	Your own Prospeo or Hunter API key. Only used when findEmails is on. You pay your provider directly for lookups. No key? Get one from Prospeo (referral link) — 100 free lookups/month.
maxConcurrency	integer	3	Parallel search requests (kept modest).
proxyConfiguration	object	GOOGLE_SERP	Defaults to Apify's GOOGLE_SERP proxy group (required to read search results reliably).

At least one of companies or searchQuery is required — with neither, the run stops with a clear "nothing to search" error.

Example input

Find decision-makers at specific companies (company mode):

{
  "companies": [
    { "name": "Monzo", "domain": "monzo.com" },
    "stripe.com",
    "Acme Dental"
  ],
  "roleKeywords": ["CEO", "founder", "director", "head of"],
  "maxResultsPerTarget": 5
}

Find people by role and location (free-form mode):

{
  "searchQuery": "marketing director Manchester",
  "maxProfiles": 25
}

You can also pass both — the actor searches each company and the free-form query in the same run.

How to run

1. Click Try for free (or open the actor in your Apify Console).
2. Either paste your companies (names and/or domains) or type a free-form query like marketing director Manchester.
3. (Optional) Tune roleKeywords to bias toward the seniority you want.
4. Set maxProfiles (and maxResultsPerTarget) to cap your spend.
5. Click Start. When the run finishes, open the Dataset tab and export to JSON/CSV/Excel, or pull it via the API (below).

Run it on a schedule (Apify Schedules) to refresh a target list, or call it from Make / Zapier / n8n via the Apify integrations.

Output

Each item in the dataset is one person. Here is an example for a company-mode run with findEmails on and a valid key:

{
  "type": "profile",
  "name": "John Smith",
  "title": "Chief Information Security Officer",
  "company": "Monzo",
  "profileUrl": "https://www.linkedin.com/in/john-smith-monzo",
  "matchedOn": "domain",
  "source": "google-linkedin",
  "targetCompany": "Monzo",
  "targetDomain": "monzo.com",
  "query": null,
  "email": "john.smith@monzo.com",
  "emailStatus": "VALID",
  "emailConfidence": null
}

When findEmails is off (default) or no emailApiKey is supplied, or the profile came from a free-form query (no company domain), these fields are always null:

"email": null,
  "emailStatus": null,
  "emailConfidence": null

Field notes:

• name / title are parsed from the public search-result title (e.g. "John Smith — CISO at Monzo"). A person-name guard rejects company names and boilerplate, so you don't get junk rows.
• profileUrl is the public linkedin.com/in/... URL — open it, or enrich it in your CRM.
• matchedOn tells you why we trusted this result belongs to your target: domain, businessName, or urlSlug in company mode, or query in free-form mode.
• company is best-effort — parsed from the title's "… at <Company>" when present, otherwise null.
• targetCompany / targetDomain echo the company you searched (both null for free-form queries); query holds your free-form text (and is null in company mode).
• email is the verified work email returned by your provider. null unless findEmails is on, a key is supplied, and the profile has a company domain. We never fabricate — the provider's verdict is passed through unchanged.
• emailStatus is the provider's verification verdict (e.g. VALID for Prospeo, valid for Hunter). null when no email was found.
• emailConfidence is the numeric confidence score (Hunter only, 0–100). null for Prospeo and for any profile without a found email.

A run that finds nobody doesn't return a silent blank dataset — it sets a clear status message with tips (add a domain, widen roleKeywords, try searchEngine: "bing").

Finding emails

Turn on findEmails and supply your own Prospeo or Hunter.io API key to add a verified work email to each company-mode profile.

Don't have a key yet? We recommend Prospeo (referral link) — it's the provider we test this actor against, and it gives 100 free lookups/month to start. Create an account, copy your API key, and paste it into emailApiKey. The actor also supports Hunter.io — set emailProvider to hunter if you use that instead.

How it works:

1. After each profile is matched, the actor calls your provider's email-finder endpoint. For Prospeo, it matches on the person's exact LinkedIn profile URL for the highest accuracy (falling back to name + company domain); Hunter uses name + company domain.
2. If the provider returns a verified email, it is written to email + emailStatus (and emailConfidence for Hunter).
3. You are charged $0.002 per email returned by us (via Apify Pay-Per-Event), plus your provider's own per-lookup charge.

Requirements and limits:

• findEmails must be true and a non-empty emailApiKey must be supplied.
• Only company-mode profiles get enriched — profiles matched via targetDomain have the domain the provider needs. Free-form query results (query mode) and profiles from name-only company entries that couldn't resolve a domain will always return email: null.
• Set emailProvider to prospeo (default) or hunter to match your key.
• You pay your provider directly. We never proxy or store your API key beyond the run.

Example input with email enrichment:

{
  "companies": [{ "name": "Monzo", "domain": "monzo.com" }],
  "maxProfiles": 10,
  "findEmails": true,
  "emailProvider": "prospeo",
  "emailApiKey": "YOUR_PROSPEO_KEY"
}

Export & API

# Last run's dataset items as JSON
curl "https://api.apify.com/v2/datasets/<DATASET_ID>/items?format=json&token=<APIFY_TOKEN>"

Or use the run-sync-get-dataset-items endpoint to run-and-wait in a single call — handy for embedding the actor in your own backend.

Limitations

• Profiles are snippet-derived. We read what search engines have indexed, so decision-maker coverage varies by company — some targets return five named profiles, others return one or two. Adding a domain alongside the company name improves matching.
• Free-form mode is noisier. A query like "marketing director Manchester" casts a wide net and can return loosely-relevant people; company mode (with a domain) is the precise path.
• Name collisions. A company name that's also a common surname (e.g. "Baker", "Marshall") can occasionally match an unrelated person. Pass a domain to disambiguate — that's the strongest match signal.
• Emails require opt-in and a company domain. Set findEmails: true and supply a Prospeo or Hunter emailApiKey to get work emails. Free-form query mode and name-only companies that couldn't resolve a domain return email: null — the provider needs a domain to look up.

Compliance

This actor reads public search-engine snippets only. It does not log into LinkedIn, fetch the LinkedIn profile page, use cookies or an li_at token, or access anything behind authentication. It reads results through Apify's SERP proxy and runs at modest concurrency. You are responsible for using the returned data in line with applicable privacy and outreach laws (GDPR, CAN-SPAM, and any rules that apply to you).

FAQ

How do I find LinkedIn profiles by company? Put each company in companies — as a {name, domain} object or a plain string. The actor searches public results for that company and returns the decision-maker profiles it can confirm belong to it. Adding the domain gives the most accurate matches.

Can it find a LinkedIn profile URL for me? Yes — every dataset item includes profileUrl, the public linkedin.com/in/... link. That's the core of what this LinkedIn profile URL finder does: turn a company or role into named people with their profile URLs.

Does it log into LinkedIn — will it ban my LinkedIn account? No. It never logs in, never opens a LinkedIn profile page, and never uses your cookie or li_at. It only reads public Google/Bing search snippets, so there's no account of yours involved and nothing to get banned. That's the whole point of scraping LinkedIn data without login.

Do I need a LinkedIn account, cookie, or API key? No — none of those. You don't supply a LinkedIn login, an li_at cookie, or a search-API key. Google searches run through Apify's GOOGLE_SERP proxy out of the box.

Does it find emails? Yes — turn on findEmails and supply your Prospeo or Hunter key via emailApiKey, and we return the provider-verified work email for each company-domain profile. Set emailProvider to prospeo (default) or hunter to match your key. Need a key? Start with Prospeo (referral link) — 100 free lookups/month. Free-form query results and name-only companies without a domain return email: null — a company domain is required for the lookup. We never fabricate an address: the provider's verdict is passed through unchanged.

What does it cost to find emails? You pay two charges: your provider's own per-lookup fee (check Prospeo or Hunter's pricing), plus $0.002 per email returned to us as an Apify Pay-Per-Event email event. The $0.002 event is only charged when the provider actually returns a verified email — unsuccessful lookups are not charged by us.

When should I use company search vs role search? Use company mode (companies, ideally with a domain) when you have target accounts and want the right people inside them — it's the precise path. Use free-form mode (searchQuery) to discover people by role and location when you don't have a company list — it's broader and a bit noisier.

How is it priced and how do I control cost? Apify Pay-Per-Event — you're charged per profile returned ($0.004/profile) and, when findEmails is on, an additional $0.002 per email returned (the email event). Set maxProfiles (run-wide cap) and maxResultsPerTarget (per-company cap) to control spend; non-matching and duplicate results are never charged. Email lookups that return no address are not charged by us (though your provider may still count them against your plan).

How fresh is the data? It reads live search results on each run, so freshness tracks what Google/Bing currently index for each profile. Re-run on a schedule to refresh a target list.

What if a run finds nobody? You'll get a clear status message (not a silent empty dataset) suggesting fixes — add a company domain, widen roleKeywords, or switch searchEngine to bing.

---

Want this fully automated?

This actor finds the decision-makers. If you'd like the whole loop — finding the right people, enriching their contact details, AI-personalised outreach, and reply handling — done for you, that's what we build at SignalEngine. This actor is a taste of the engine that powers it.

Looking for buyer-intent leads instead of named decision-makers? See our Reddit Lead Finder.