---
title: "How to connect HiBob (Bob) to Unified with OAuth 2.0"
img: https://unified.to/images/logo.svg
date: 2026-11-06T16:28:00.000Z
updated: "2026-11-06T17:06:07.384Z"
tag: Guides
integrations: 
description: "Unified connects to HiBob with OAuth 2.0, which is the method HiBob recommends for Marketplace and technology partners. Your customers approve access on Bob's..."
url: "https://docs.unified.to/guides/how_to_connect_hibob_bob_to_unified_with_oauth_2_0"
---

# How to connect HiBob (Bob) to Unified with OAuth 2.0
------
_November 6, 2026_

Unified connects to HiBob with **OAuth 2.0**, which is the method HiBob recommends for Marketplace and technology partners. Your customers approve access on Bob's consent screen. They don't create a Service User or copy any tokens.

> Connecting with a Service User ID and token? That method is deprecated for new connections. See "Migrating from a Service User connection" below.

## Before you start

- A **HiBob Marketplace / technology partner** account. HiBob only issues OAuth app credentials to approved partners. To apply, use [HiBob's partner program](https://dash.partnerstack.com/application?company=hibob&group=techpartnerapplication&gref=page).
- Access to the **HiBob Developer Portal**, where you create your app.
- A [Unified.to](https://unified.to/) workspace.

## Step 1: Create your app in the HiBob Developer Portal

1. Sign in to the HiBob Developer Portal and create a new app ([HiBob guide: Add and submit an app](https://apidocs.hibob.com/docs/add-and-submit-an-app)).
2. Set the app's **Redirect URI** to Unified's HiBob callback:

```javascript
https://api.unified.to/hb/{YOUR_WORKSPACE_ID}/Production/connection
```

- Replace `{YOUR_WORKSPACE_ID}` with your Unified workspace ID (in the Unified app under **Settings**).
- EU workspaces use `https://api-eu.unified.to/...`, and AU workspaces use `https://api-au.unified.to/...`.
- For a sandbox environment, replace `Production` with your Unified environment name.
1. Select the **scopes** your product needs. Request only what you use

Some HiBob endpoints only offer a `:write` scope, which also covers reading. See HiBob's [scopes mapping](https://apidocs.hibob.com/reference/scopes-mapping-to-endpoints).

1. Save the app and copy its **App ID**, **Client ID** and **Client Secret**.

## Step 2: Add your credentials to Unified

1. In the Unified app, go to **Integrations** and select **HiBob**.
2. Choose **OAuth 2** as the authorization method.
3. Enter your **Client ID**, **Client Secret** and **App ID**.
4. Select the same permissions you chose in Step 1, then save.

## Step 3: Connect a customer's Bob account


There are two ways for a customer to connect:

- **From your app, using Unified's Authorization flow or embedded component.** The customer picks HiBob, gets sent to Bob, signs in as a Bob admin, approves the requested permissions, and comes back to your app with a connection.
- **From the Bob Marketplace.** The customer installs your app from your Bob Marketplace listing. Bob redirects to the Redirect URI from Step 1, and Unified creates the connection automatically.

Either way, Unified stores the connection under the customer's HiBob `companyId` and refreshes access tokens automatically. HiBob access tokens are short-lived, so you never have to handle them yourself.


## Migrating from a Service User connection


If your customers already connect with a Service User ID and token:

1. Complete Steps 1 and 2 above.
2. Ask each customer to reconnect HiBob through the OAuth flow (Step 3).
3. Once the new OAuth connection is working, delete the old Service User connection. Then ask the customer to remove the Service User in Bob (**Settings › Integrations › Automation › Service Users**).

## Troubleshooting

- **"redirect_uri mismatch" or the install loops back to Bob:** the Redirect URI in the HiBob Developer Portal must exactly match the one in Step 1, including region, workspace ID and environment.
- **Data is missing but no error appears:** the app is missing a scope for that object. Add it in the Developer Portal and in Unified, then reconnect.
- **401 / 403 on every call:** check that the Client ID, Client Secret and App ID in Unified match the app in the Developer Portal.