DEV Community: jacobgadek

How to Automate LinkedIn Without Getting Blocked

jacobgadek — Wed, 14 Jan 2026 14:40:24 +0000

LinkedIn automation is a nightmare. If you've ever tried to scrape your connections or automate DMs, you know the pain:

Login Scripts Fail: LinkedIn detects Selenium/Playwright login attempts instantly.
2FA is a Blocker: You can't automate the OTP step easily.
Account Flagging: Repeated logins from "clean" headless browsers look suspicious.

I spent days trying to build a robust login bot. Then I realized I was solving the wrong problem.

Why hack the login door when I'm already inside?

The Solution: Session Handoff

Instead of teaching your bot to log in, you should just hand it your existing Chrome session.

Your local browser already holds the "Golden Ticket": a valid, authenticated session cookie that LinkedIn trusts. I built a tool called Romek to grab that ticket and pass it to your automation scripts.

Step-by-Step Guide

1. Install Romek

Romek is the bridge between your local Chrome browser and your Python script.

pip install romek

2. Grab your LinkedIn Session

Run this one command in your terminal. It extracts the encrypted cookies from Chrome, decrypts them safely, and stores them in a local vault.

# This grabs cookies specifically for linkedin.com
romek grab linkedin.com

(Note: You need to be logged into LinkedIn on Chrome for this to work)

3. Inject into Playwright

Now, tell your bot to use those cookies. No username, no password, no 2FA.

from playwright.sync_api import sync_playwright
from romek import Vault

# 1. Retrieve the valid session
vault = Vault()
cookies = vault.get_session("linkedin.com")

with sync_playwright() as p:
    browser = p.chromium.launch(headless=False) # Headless=False lets you see the magic
    context = browser.new_context()

    # 2. Inject the cookies BEFORE navigating
    context.add_cookies(cookies)

    page = context.new_page()

    # 3. Go straight to the feed
    page.goto("https://www.linkedin.com/feed/")

    # Success! You are already logged in.
    print(page.title())

    # ... insert your scraping logic here ...

Why This is Safer

Residential IP Match: If you run this locally, your bot shares your exact IP address.
Correct Headers: You aren't generating a fresh, empty fingerprint. You are continuing an existing, trusted session.
Zero Credential Risk: You never hardcode your password or manage .env files for secrets.

Supports More Than Just Python

If you are into low-code automation, I also built an n8n node that does this exact same thing for workflow automation.

Reverse-Engineering Chrome's Cookie Encryption (To Authenticate AI Agents)

jacobgadek — Sun, 11 Jan 2026 18:52:50 +0000

If you've built AI agents that interact with websites, you've hit this wall: login screens.

Your agent needs to check LinkedIn notifications, scrape a dashboard, or post to a platform. But the site demands authentication. So you do what every developer does at first — you open Chrome DevTools, copy the Cookie header, and paste it into your script.

It works. For about 24 hours. Then the session expires, your automation breaks at 3am, and you wake up to angry alerts.

I got tired of this cycle. Chrome already has my authenticated sessions stored locally. I'm logged into LinkedIn right now. What if my agent could just... use that?

Turns out it can. But Chrome doesn't make it easy.

Where Chrome Stores Cookies

Chrome stores cookies in a SQLite database. The location depends on your OS:

Mac:

~/Library/Application Support/Google/Chrome/Default/Cookies

Linux:

~/.config/google-chrome/Default/Cookies

Windows:

%LOCALAPPDATA%\Google\Chrome\User Data\Default\Network\Cookies

You can open it with any SQLite client:

sqlite3 ~/Library/Application\ Support/Google/Chrome/Default/Cookies

The schema looks like this:

sqlite> .schema cookies
CREATE TABLE cookies(
  creation_utc INTEGER NOT NULL,
  host_key TEXT NOT NULL,
  name TEXT NOT NULL,
  value TEXT NOT NULL,
  encrypted_value BLOB NOT NULL,
  path TEXT NOT NULL,
  expires_utc INTEGER NOT NULL,
  is_secure INTEGER NOT NULL,
  is_httponly INTEGER NOT NULL,
  ...
);

Let's query LinkedIn's cookies:

SELECT name, value, encrypted_value FROM cookies WHERE host_key LIKE '%linkedin%';

You'll see something like:

name: li_at
value: (empty)
encrypted_value: v10[blob of binary garbage]

The value column is empty. Everything interesting is in encrypted_value. And that blob? It's encrypted.

How Chrome Encrypts Cookies

Chrome started encrypting cookies around 2014 to prevent malware from trivially stealing sessions. The encryption varies by platform.

Mac: Keychain + AES-128-CBC

On macOS, Chrome:

Stores a master key in the macOS Keychain under "Chrome Safe Storage"
Derives an encryption key using PBKDF2 with:
- Password: the Keychain-stored key
- Salt: saltysalt (yes, literally the string "saltysalt")
- Iterations: 1003
- Key length: 16 bytes (AES-128)
Encrypts each cookie value with AES-128-CBC
Prepends v10 to indicate the encryption version

Linux: libsecret + AES-128-CBC

Linux uses a similar approach but stores the key in GNOME Keyring or KWallet via libsecret. If no keyring is available, Chrome falls back to a hardcoded key: peanuts (again, literally).

Windows: DPAPI

Windows uses the Data Protection API (DPAPI), which ties encryption to the Windows user account. This is actually more secure since there's no extractable key — decryption only works for the logged-in user.

Decrypting Cookies with Python

Let's write the decryption. I'll focus on macOS since that's what I use, but the approach is similar for Linux.

Step 1: Get the encryption key from Keychain

import subprocess

def get_chrome_key_mac():
    cmd = [
        'security', 'find-generic-password',
        '-s', 'Chrome Safe Storage',
        '-w'
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    return result.stdout.strip()

Step 2: Derive the AES key

from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.backends import default_backend

def derive_key(chrome_key):
    kdf = PBKDF2HMAC(
        algorithm=hashes.SHA1(),
        length=16,
        salt=b'saltysalt',
        iterations=1003,
        backend=default_backend()
    )
    return kdf.derive(chrome_key.encode())

Step 3: Decrypt the cookie

from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes

def decrypt_cookie(encrypted_value, key):
    # v10 prefix indicates encryption version
    if encrypted_value[:3] != b'v10':
        return encrypted_value.decode()  # Not encrypted

    encrypted_value = encrypted_value[3:]  # Remove prefix

    # AES-128-CBC with 16-byte IV of spaces
    iv = b' ' * 16
    cipher = Cipher(
        algorithms.AES(key),
        modes.CBC(iv),
        backend=default_backend()
    )

    decryptor = cipher.decryptor()
    decrypted = decryptor.update(encrypted_value) + decryptor.finalize()

    # Remove PKCS7 padding
    padding_len = decrypted[-1]
    return decrypted[:-padding_len].decode()

Putting it together

import sqlite3
import shutil
import tempfile

def get_linkedin_cookies():
    # Copy database (Chrome locks the original)
    cookie_path = os.path.expanduser(
        '~/Library/Application Support/Google/Chrome/Default/Cookies'
    )

    with tempfile.NamedTemporaryFile(delete=False) as tmp:
        shutil.copy2(cookie_path, tmp.name)

        conn = sqlite3.connect(tmp.name)
        cursor = conn.cursor()

        cursor.execute('''
            SELECT name, encrypted_value 
            FROM cookies 
            WHERE host_key LIKE '%linkedin%'
        ''')

        chrome_key = get_chrome_key_mac()
        aes_key = derive_key(chrome_key)

        cookies = {}
        for name, encrypted_value in cursor.fetchall():
            cookies[name] = decrypt_cookie(encrypted_value, aes_key)

        conn.close()
        os.unlink(tmp.name)

        return cookies

# Usage
cookies = get_linkedin_cookies()
print(cookies)
# {'li_at': 'AQEDAT...', 'JSESSIONID': 'ajax:123...', ...}

It works. You now have decrypted session cookies that you can use in requests:

import requests

response = requests.get(
    'https://www.linkedin.com/feed/',
    cookies=cookies
)
# You're authenticated

Why a Script Isn't Enough

So we can decrypt cookies. Problem solved?

Not quite. This script has issues:

Security: The decrypted cookies are now in plaintext in your script's memory, your logs, potentially your git history. Session tokens are as sensitive as passwords.

No scoping: Any script can access any cookie. Your "LinkedIn agent" can also read your bank cookies. That's a security nightmare.

No audit trail: When something goes wrong (and it will), you have no idea which agent accessed what, when.

Session management: Cookies expire. Sites rotate tokens. You need to track freshness and know when to re-authenticate.

Multi-agent chaos: When you have 5 agents accessing 10 sites, the cookie management becomes its own project.

From Script to Tool

This is why I built AgentAuth.

The architecture:

┌─────────────────┐     ┌─────────────────┐     ┌─────────────────┐
│ Chrome Extension│────▶│ Encrypted Vault │────▶│   Your Agent    │
│  (export once)  │     │   (AES-256)     │     │  (scoped access)│
└─────────────────┘     └─────────────────┘     └─────────────────┘

Chrome Extension: You click "Export" while logged into a site. The extension captures the cookies and sends them to the local vault. No more DevTools copy-paste.
Encrypted Vault: Cookies are stored in a local SQLite database, encrypted with AES-256 using a password you control. Not scattered across scripts.
Scoped Agents: You create named agents with specific domain access. Your linkedin-agent can only access linkedin.com cookies. It can't touch your bank.
Audit Logging: Every access is logged with timestamp, agent name, and domain.

The code becomes:

from agent_auth import Vault

vault = Vault()
vault.unlock("password")
cookies = vault.get_session("linkedin.com")

# Use with requests
response = requests.get('https://linkedin.com/feed', cookies=cookies)

# Or with Playwright
context.add_cookies(cookies)

One line to get authenticated cookies. No decryption code. No hardcoded tokens. No security nightmares.

The Bigger Picture

Here's what I realized while building this: session management for AI agents is unsolved infrastructure.

We have OAuth for user-facing apps. We have API keys for server-to-server. But AI agents? They're stuck with the same hacks we used in 2010 for web scraping.

The industry is building increasingly sophisticated agents — agents that can browse, fill forms, make purchases. But we're still copy-pasting cookies from DevTools.

AgentAuth is my attempt to fix this. It's open source, works today on any site (no OAuth adoption required), and integrates with LangChain, Playwright, and n8n.

Links:

GitHub: github.com/jacobgadek/agent-auth
PyPI: pip install agentauth-py
n8n node: npm install n8n-nodes-agentauth

If you're building agents that need authentication, give it a try. And if you want to contribute — especially Windows DPAPI support or a Firefox extension — PRs are welcome.

If you found this useful, consider starring the repo. It helps others discover the project.

How to Handle Authentication for AI Agents (Without Hardcoding Cookies)

jacobgadek — Sat, 10 Jan 2026 17:31:22 +0000

How to Handle Authentication for AI Agents (Without Hardcoding Cookies)

If you're building AI agents that interact with websites, you've probably run into this problem: your agent needs to be logged in.

The common solution? Hardcode cookies in your code:

# What everyone does (don't do this)
cookies = {"session_id": "abc123", "auth_token": "xyz789"}
response = requests.get("https://example.com/dashboard", cookies=cookies)

This works until it doesn't:

Sessions expire and your agent breaks
Cookies leak into git repos
No way to track which agent accessed what
One leaked cookie = compromised account

The Real Problem: Agents Don't Have Identities

When a human logs into a website, they have an identity. They authenticate, get a session, and the site knows who they are.

AI agents? They're identity ghosts. They borrow your cookies, pretend to be you, and hope nothing breaks.

This is fine when you have one agent running locally. But what happens when you have:

Multiple agents accessing different services
Agents running in production
A team where everyone has their own credentials

You need a real solution.

What Good Agent Auth Looks Like

After dealing with this problem repeatedly, I built AgentAuth — an open-source SDK that handles this properly.

Here's how it works:

1. Export Cookies From Your Browser

Instead of manually copying cookies from dev tools, use a Chrome extension:

Go to the site (logged in)
Click the extension
Click "Export Session Cookies"
Done

2. Store Them Encrypted

Sessions are stored in an encrypted vault on your machine — not in your code, not in environment variables.

agent-auth init  # Set up the vault
agent-auth add github.com  # Paste the exported cookies

3. Give Each Agent an Identity

Every agent gets a cryptographic identity (Ed25519 keys) and scoped permissions:

agent-auth create-agent github-bot --scopes github.com

This agent can ONLY access github.com. It can't touch your LinkedIn or Gmail sessions.

4. Retrieve Sessions Securely

from agent_auth import Agent, AgentAuthClient

agent = Agent.load("github-bot")
client = AgentAuthClient(agent)
cookies = client.get_session("github.com")

# Now use the cookies
response = requests.get("https://github.com/notifications", cookies=cookies)

5. Everything is Logged

Every session access is logged. You know exactly which agent accessed which domain and when.

Why This Matters

Right now, there are thousands of AI agents running with hardcoded cookies. As agents become more common, this becomes a massive security hole.

Think about it:

Agents accessing company data
Agents running automations on your behalf
Agents with access to sensitive accounts

Do you really want all of that authenticated with copy-pasted cookies in a .env file?

Try It

AgentAuth is open source:

pip install agent-auth

GitHub: https://github.com/jacobgadek/agent-auth

It takes 5 minutes to set up:

agent-auth init
Export cookies with the Chrome extension
agent-auth add <domain>
Use AgentAuthClient in your code

If you're building agents, give it a try. I'd love feedback.

Building something with AI agents? I'm working on making agent authentication a solved problem. Follow along on Twitter or check out the GitHub repo.