Hibob (OAuth)
Service ID: hibob-oauth
bob is a people management platform that helps fast-growing companies bring out the best in their employees. OAuth 2.0 authorization-code flow for multi-tenant connections.
At a Glance
- Difficulty
- ⚠️INVOLVEDApproved HiBob Partnership Required + Marketplace App Technical Review
- Authentication
- OAuth 2.0Authorization Code flow through a HiBob Marketplace app install. Your consumer connects in one click.
- Webhooks
- Virtual webhooks↗ (Apideck polls for employee created, updated and terminated events). HiBob's native webhooks are not used.
- Partnership Required
- Yes(HiBob registers OAuth apps only for approved Marketplace and technology partners, so you join the programme and register your own app.)
- Partnership Application
- HiBob Tech Partner Program↗
- Apideck Credentials
- Not available(You register your own HiBob Marketplace app and supply its Client ID, Client Secret and App ID.)
- Costs
- No separate API fee.
- Sandbox Availability
- Available(Partner test accounts run on the production API host. HiBob's Sandbox is a paid customer add-on served from api.sandbox.hibob.com.)
- Account Type Required
- An approved HiBob Tech Partner account with a registered Marketplace app for you; any HiBob (Bob) tenant for your consumer.
- Consumer Access Level
- A Bob admin, or a user with permission to install Marketplace apps.
- Rate Limits
- Per-endpoint limits varying by endpoint family, around 50 requests/minute on people search. Repeated 401 or 403 responses also trip a firewall IP block.
Responsibility matrix
| Task | You (Customer) | Your Consumer | Apideck |
|---|---|---|---|
| Join the HiBob Tech Partner Program | ✓ | — | Guidance provided |
| Register the HiBob Marketplace app | ✓ | — | Documentation provided |
| Pass HiBob's Technical Review | ✓ | — | Support available |
| Enter Client ID, Client Secret and App ID | ✓ | — | Dashboard available |
| Authorize the connection | Implement Vault | ✓ (Bob admin) | Runs the OAuth exchange |
| Keep the connection authenticated | — | — | ✓ Refreshes tokens |
| Build via the Unified API | ✓ | — | Maintains the connector |
| Connection sync | — | — | ✓ Polls via virtual webhooks |
| Revoke access | — | ✓ | — |
| Monitor connections | ✓ Via the Apideck Dashboard | — | Logs and alerts |
Environments
- Sandbox
- api.sandbox.hibob.com, only for Bob accounts that purchased HiBob's Sandbox add-on (a copy of the customer's production tenant) with your app installed in that sandbox tenant. Any other account gets 401 on every call. HiBob does not document OAuth apps against this host; confirm with your HiBob partner contact before selecting it.
- Production
- api.hibob.com, paired with Production credentials, which HiBob issues only after its Technical Review. In Apideck the API host (Environment) and the credential set (Credentials Type) are two separate settings, and both must match the tenant and app stage you are targeting. Development credentials CANNOT be used with production accounts.
🚨Important to Know About Hibob (OAuth)
- Going live through HiBob's standard route publishes a listing on the Bob Marketplace, so your integration becomes publicly visible there.
- HiBob's Security Badge Certification is optional and does not block go-live, but skipping it publishes your listing without the badge and with a disclaimer saying the app is not security certified. You can certify or resubmit at any time.
- Disconnecting takes two steps: the consumer must disconnect in Apideck and uninstall the app in Bob. HiBob exposes no install state, so doing only one leaves the connection either failing with 401s or still showing as connected.
- Apideck refreshes tokens automatically, but HiBob's refresh window is 30 days: a connection left idle longer than that stops working and the consumer has to reconnect.
⚠️
4 gotchas across 1 resource
Connector-specific behaviors and limitations to be aware of
📦
3 supported resources
View field mappings, supported operations, and schema details