Hibob (OAuth)
Service ID: hibob-oauth
bob is a people management platform that helps fast-growing companies bring out the best in their employees. OAuth 2.0 authorization-code flow for multi-tenant connections.
At a Glance
- Difficulty
- ⚠️INVOLVEDApproved HiBob Partnership Required + Marketplace App Technical Review
- Authentication
- OAuth 2.0OAuth 2.0 authorization code flow through a HiBob Marketplace app install. Your consumer connects in one click.
- Webhooks
- Virtual webhooks (Apideck polls for employee created, updated and terminated events). HiBob's native webhooks are not used.
- Partnership Required
- Yes(Required of you, not of your consumers: HiBob registers OAuth apps only for approved Marketplace and technology partners.)
- Partnership Application
- HiBob Tech Partner Program (administered through PartnerStack)↗
- Apideck Credentials
- Not available(Not available: you register your own HiBob Marketplace app and supply its Client ID, Client Secret and App ID.)
- Costs
- No separate API fee. Your consumers need a HiBob subscription, which is sales-led and not publicly priced; HiBob's Sandbox is a paid add-on.
- Sandbox Availability
- Available(HiBob's Sandbox host is a paid add-on most consumers will not have. The Tech Partner Terms give you a dedicated Bob test account, which is where you build.)
- Account Type Required
- An approved HiBob Tech Partner account with a registered Marketplace app for you; any HiBob (Bob) tenant for your consumer.
- Consumer Access Level
- A Bob admin, or a user with permission to install Marketplace apps.
- Rate Limits
- Per-endpoint limits varying by endpoint family, around 50 requests/minute on people search. Repeated 401 or 403 responses also trip a firewall IP block.
Responsibility matrix
| Task | You (Customer) | Your Consumer | Apideck |
|---|---|---|---|
| Join the HiBob Tech Partner Program | ✓ | — | Guidance provided |
| Register the HiBob Marketplace app | ✓ | — | Documentation provided |
| Pass HiBob's Technical Review | ✓ | — | Support available |
| Enter Client ID, Client Secret and App ID | ✓ | — | Dashboard available |
| Authorize the connection | Implement Vault | ✓ (Bob admin) | Runs the OAuth exchange |
| Keep the connection authenticated | — | — | ✓ Refreshes tokens |
| Build via the Unified API | ✓ | — | Maintains the connector |
| Connection sync | — | — | ✓ Polls via virtual webhooks |
| Revoke access | — | ✓ | — |
| Monitor connections | ✓ Via the Apideck Dashboard | — | Logs and alerts |
Environments
- Sandbox
- api.sandbox.hibob.com, paired with Development credentials from the HiBob developer portal.
- Production
- api.hibob.com, paired with Production credentials, which HiBob issues only after its Technical Review. In Apideck the API host (Environment) and the credential set (Credentials Type) are two separate settings, and both must match the tenant and app stage you are targeting. Development credentials CANNOT be used with production accounts.
🚨Important to Know About Hibob (OAuth)
- Going live through HiBob's standard route publishes a listing on the Bob Marketplace, so your integration becomes publicly visible there.
- HiBob's Security Badge Certification is optional and does not block go-live, but skipping it publishes your listing without the badge and with a disclaimer saying the app is not security certified. You can certify or resubmit at any time.
- Disconnecting takes two steps: the consumer must disconnect in Apideck and uninstall the app in Bob. HiBob exposes no install state, so doing only one leaves the connection either failing with 401s or still showing as connected.
- Apideck refreshes tokens automatically, but HiBob's refresh window is 30 days: a connection left idle longer than that stops working and the consumer has to reconnect.
⚠️
4 gotchas across 1 resource
Connector-specific behaviors and limitations to be aware of
📦
3 supported resources
View field mappings, supported operations, and schema details