Open source and privacy-focused LinkedIn tools

"Open source LinkedIn scheduler" is three searches stacked on one phrase. Open source means you can read the code and, under that licence, run it. Privacy-focused means who holds the LinkedIn token and who holds the model key. A scheduler means a calendar that publishes a post you already approved. Those three properties do not arrive as one product.

The landscape that exists in October 2026 is smaller than the GitHub topic pages suggest. Postiz is a real AGPL-3.0 scheduler you can self-host, and its cloud product publishes to LinkedIn among many other networks. Mixpost Lite is a real MIT project, and Mixpost's own pricing page says LinkedIn is on the paid licence, not on Lite. Browser tools that ask for a LinkedIn password or a session cookie are a third category, and LinkedIn's help pages treat them as unauthorized automation of the website. Boykli is a fourth shape: a hosted LinkedIn product for one personal profile, with a BYOK seat so the model key is yours, and with no public source repository.

This page is the map. Prices and licence lines below were read from the vendors' own pages on 26 October 2026. Recheck them before you buy.

Four shapes, and what each one actually ships

Boykli's two seats are the same screens. The difference is the invoice for the model. How that split is wired, including the refusal to borrow a platform key when a BYOK key is missing, is BYOK LinkedIn tool. The queue itself, weekdays and one clock, is LinkedIn scheduling tool.

What the open-source label buys, and where LinkedIn drops out

Postiz changed its licence to AGPL-3.0 in the v1.25.1 release notes. The maintainers' own summary of that change is that commercial use is allowed, and that a modification you offer as a network service has to ship its source. The public repository page, read on 26 October 2026, showed about 37.8k stars. Treat the star count as a freshness signal, not a quality score, and recheck the repo.

The README draws a clean line between Postiz Cloud and the open-source edition. Cloud is a subscription, with a 7-day trial, and Postiz holds the pre-approved network apps. Self-hosting is the AGPL code on your machine: Docker or another VPS, your Postgres, your Redis, your storage, and your own developer apps. Their pricing FAQ says you do not have to pay Postiz for that app approval. They also sell approval as an optional service because Meta, TikTok, and YouTube reviews take weeks. LinkedIn sits in the same "you own the app" bucket on a self-hosted install.

That LinkedIn app is the part people skip. LinkedIn sells posting in separate products. Share on LinkedIn, with Sign In using OpenID Connect, is the member path. Community Management API is the organization path, and LinkedIn's developer rules, as quoted in Postiz issues #918 and #1582, require that organization product to be the only product on the application. A self-hosted personal profile therefore wants a developer app whose products are the member ones, requesting the member scopes. A company Page wants a different app, with the organization product, and LinkedIn's review. Issue #1582, opened 6 June 2026, describes a self-hosted connect that failed because the personal provider also asked for organization scopes and sent prompt=none, so LinkedIn never showed a consent screen. A pull request in that thread later narrowed the personal provider. Read the provider in the revision you deploy. The restriction that one LinkedIn app cannot hold both products is LinkedIn's, and a scheduler cannot patch it.

Boykli never asks you to create that app. The consent screen is LinkedIn's, the grant is w_member_social for the member, and the destination is that personal profile. A company Page admin role does not open a Page queue. If the job is "our company Page plus five other networks," Boykli is the wrong row of the table.

Mixpost's split is sharper, and it is on their pricing page rather than in an issue. Lite includes Facebook Pages, X, and Mastodon, plus a calendar, a media library, and basic analytics. Pro, at $299 for one domain, is the row that says "publish on all social platforms," and the FAQ names LinkedIn profiles and company Pages there. Pro also adds the posting queue, approval flow, AI assistant, first comment, API, MCP, and webhooks. Updates on a paid licence run for one year. The version you bought keeps working after that, which they call a perpetual fallback. Lite updates stay free. Calling Lite "an open source LinkedIn scheduler" repeats a sentence their own plan card contradicts.

Cloud is the third Mixpost door: they host it, the LinkedIn page offers a 7-day trial, and the self-hosted prices above are not the cloud card. Recheck mixpost.app/cloud for the monthly number. Recheck postiz.com/pricing the same way. On 26 October 2026 that Postiz card was Standard $29, Team $39, Pro $49, and Ultimate $99 a month, or $23, $31, $39, and $79 on annual billing, with channels at 5, 10, 30, and 100.

Privacy is three questions, and they have different answers

People use "privacy-focused" for any of these. They are independent.

Where the LinkedIn token sits. On a self-hosted Postiz or Mixpost Pro install, the token sits in a database you administer. Mixpost's FAQ says access tokens are encrypted at rest and that passwords are hashed with bcrypt. That is a real residency claim: the disk is yours, the region is yours, and a vendor shutdown does not delete the queue. It is also an operations claim. You patch the box, you back it up, and you rotate the LinkedIn app secret when it leaks from your env file.

On Boykli the token sits on Boykli's server after you approve the app. The privacy page covers that processing. Self-hosting wins if the requirement is "the token never leaves a machine I own." Boykli wins if the requirement is "I will not operate Postgres, Redis, a LinkedIn developer app, and a certificate renewal to publish three posts a week."

Where the model key sits. This is the question the open-source schedulers do not answer, because writing is not their product. A caption box with an AI add-on still sends the prompt to whichever model you configured, on your server or on theirs. Boykli's BYOK seat is specific: Settings stores the OpenRouter key and the Google AI Studio key encrypted, the privacy page says they are not shown back in full, the server decrypts them for the outbound call, and a missing key fails the call. It does not fall through to Boykli's xAI, OpenAI, Anthropic, or Vertex accounts. Deleting the key removes it. Managed is the other contract: Boykli holds the platform keys, and the caps above are the meter. Neither sentence means the model vendor is blind. OpenRouter sees a BYOK chat call. Google sees a BYOK Voice Agent session. Encryption at rest is about the key in Boykli's database, not about a private inference path.

Whether the tool acts on LinkedIn's website. Official OAuth is a grant LinkedIn shows you. A password field, a li_at cookie, or an extension that clicks the feed is the behavior named on LinkedIn's automated activity and prohibited software pages. Those pages tell a restricted member to turn the software off. The longer reading of the 2026 notes, including automated comments, is automated LinkedIn posting.

That third question is why a feature list matters more than a licence. Postiz Cloud's pricing page includes "Post comments" and describes them as scheduled replies, including on LinkedIn. It also sells Internal Plugs, which repost or comment from other connected accounts, and Global Plugs, which fire when a like count crosses a threshold. Those are engagement actions. Boykli's queue has no comment, no like, no invitation, and no message. One due item publishes, as the connected member, and the next item waits for its slot. If a plug that comments from a second account is the feature you want, you are shopping a different risk, and LinkedIn's March 2026 note on automated comments is the document to read before you turn it on.

A week on the row that matches the job

The choice is the job, written down before anyone creates a server.

1. Write the destination in one line. "My personal profile, three times a week, with the draft and a PDF carousel produced in the same tool" is a Boykli job. "The company Page, plus Instagram and a client approval" is a Postiz or Mixpost Pro job. "Facebook, X, and Mastodon, on a server I already run" is the only job Mixpost Lite claims.
2. If the line names a company Page or a second network, stop on Boykli. The product will not grow that scope because the code is hosted. Use Postiz if you want the AGPL tree and you will own the developer apps, or Mixpost Pro if you want the $299 licence and LinkedIn is on the feature list you already paid for.
3. If the line is the personal profile, decide who operates the machine. Self-hosting Postiz means Docker, the datastore, the env vars, and a LinkedIn app whose products match member posting. Budget the review time LinkedIn actually takes, and read the personal provider in the release you pull so you are not requesting organization scopes on a member app. Hosted Boykli means Settings, a seat, and LinkedIn's consent screen.
4. On Boykli, pick the seat before the first draft. BYOK at $29 a month needs an OpenRouter key and a Google AI Studio key in Settings. An empty OpenRouter balance fails the same way a rejected key does. Managed at $88 a month uses platform models inside the caps. An AppSumo lifetime code, redeemed at boykli.com/redeem, is also a BYOK seat: one code, one account, and an existing paid seat blocks redeem. The reason the cheaper seat exists is in building Boykli.
5. Connect LinkedIn as the person who should speak. The Schedule header shows Connect LinkedIn until the grant exists. The app asks for openid, profile, email, and w_member_social. It does not ask for the LinkedIn password. A token that expires leaves the rows queued until you reconnect. The publisher skips an account with no connection, no saved timezone, every weekday turned off, or no generatable plan.
6. Save the clock once. A new queue starts on Monday, Wednesday, and Friday at 10:00, in the device timezone, and the timezone is stored only after you save. Every item shares that one time of day. Drag order chooses which draft takes the earlier date. You cannot put Monday at 08:30 and Friday at 17:00 in this queue. The free composer clock, one timestamp per post, is the other tool, and the comparison is Schedule LinkedIn posts.
7. Put a finished draft on the queue. Create posts can start from a note, a YouTube video, an article, a document, or a Voice Agent session. A carousel is a PDF with a brand kit, published as a document when the slot arrives, because the organic Posts API creates that document with lifecycleState: PUBLISHED and has no future timestamp. The three-call upload and the queue that fires it are in how to schedule LinkedIn carousels. Add to Queue needs a saved deck and a document title. The same carousel cannot sit in the queue twice.
8. Read the week before it goes out. Posts ahead is what is still waiting. Scheduled through is the last slot. Remove a row you would not sign. A failed row can return to queued. Five failed attempts and that row stops retrying, so a dead token does not hammer LinkedIn. Nothing in the week comments on someone else's post.

A concrete BYOK week: Sunday evening, three edited posts and one carousel, in that order, on a queue set to Monday, Wednesday, and Friday at 09:15 in America/New_York. They take Monday, Wednesday, Friday, and the next Monday. The carousel leads if you drag it first. Each send is one item, as that member. OpenRouter bills the drafts. Boykli bills the $29. LinkedIn receives an OAuth publish, not a browser session.

What to verify before you trust a privacy sentence

Run this against any tool in the table, including Boykli.

• The login is LinkedIn's authorization screen, with a named app and a list of permissions. A form that wants the LinkedIn email password, or a field labelled with a cookie name, is the website-automation category.
• The permissions match the job. Member posting is the Share-on-LinkedIn family. Organization scopes are a Page. An app that requests both on one self-hosted client is the failure mode in the Postiz issues above.
• The data-residency sentence names a disk. "We take privacy seriously" does not. "The container's Postgres volume is on this VPS" does. "BYOK keys are encrypted and are not shown back in full" does, and it is a different disk.
• The model invoice has a payer. If the product writes with AI and you cannot point at an OpenRouter key, a Google AI Studio key, or a stated monthly cap, the writing is bundled and metered by that vendor.
• The action list stops at publish. Scheduled comments, auto-likes, connection requests, and plugs that speak from a second account are extra permissions and a different LinkedIn rule, even when the scheduler is open source.
• The licence matches the verb you will use. Reading Mixpost Lite is MIT. Running LinkedIn through Mixpost is the Pro licence. Modifying Postiz and offering the result as a service pulls AGPL obligations. Boykli has no community edition to fork.

FAQ

Is Boykli an open-source LinkedIn scheduler?

No. Boykli is a hosted product. There is no public repository and no self-host licence. The privacy lever it does offer is the BYOK seat: your OpenRouter key and your Google AI Studio key, stored encrypted, used only for that workspace. The scheduling lever is OAuth to one personal profile.

Is Mixpost Lite enough for LinkedIn?

On the pricing page read on 26 October 2026, no. Lite publishes to Facebook Pages, X, and Mastodon. LinkedIn profiles and company Pages are listed under Pro ($299, one domain) and Enterprise ($1,199). Cloud is a separate hosted trial. Recheck mixpost.app/pricing before you treat Lite as the LinkedIn install.

Do I need my own LinkedIn developer app for Boykli?

No. You approve Boykli's app on LinkedIn's screen. You do need your own app for a self-hosted Postiz, and Mixpost's self-hosted docs expect the same class of network credentials for the platforms that install enables. Member products and the Community Management API do not share one LinkedIn application.

Does "BYOK" mean the prompt stays on my laptop?

No. The key stays encrypted in Boykli until a generation runs. The call then goes to OpenRouter or, for Voice Agent and captionless YouTube, to Google AI Studio. Those vendors see the request they are paid to answer. What stays off Boykli's model account is the credential itself: a BYOK failure does not silently spend platform xAI, OpenAI, Anthropic, or Vertex quota.

Can I schedule a company Page, or a first comment, from Boykli?

No. The queue posts as the connected member. It publishes a text post or a document carousel. It does not post as an organization, and it does not file a comment under the post afterward. Postiz and Mixpost Pro advertise those Page and comment features. Read LinkedIn's automated-comment notes before you turn a comment scheduler on.

What does a cancelled Boykli seat do to the queue?

A cancellation that still has current_period_end in the future still has access, and due rows can publish. An on_hold seat, and a cancel whose period has ended, do not. Logged-in visitors can browse Radar and Algorithm with no plan. Writing, carousels, images, Voice Agent, LinkedIn publish, and schedule all wait for a generatable plan. ADMIN_EMAIL skips monthly caps only after a plan exists. It does not skip the plan.

Which row should a founder pick for a personal profile only?

Boykli, when the missing work is the draft, the carousel PDF, and one repeating local time. Postiz self-hosted, when you already run servers, you want the code, and you accept a LinkedIn app plus every other network's review. Mixpost Pro, when you want that vendor's source on your disk, LinkedIn Pages included, and a one-time licence instead of a monthly seat. Mixpost Lite, when LinkedIn is not the network.