---
title: Connecting Tines to 3B
url: https://www.tines.com/stories/docs/admin/connecting-tines-to-3b/
updated: 2026-08-11T09:19:53+00:00
---

*[tines.com](https://www.tines.com/llms.txt) › [Docs](https://www.tines.com/stories/docs/llms.txt) › [Admin](https://www.tines.com/llm/stories/docs/admin.md)*

# Connecting Tines to 3B

*[View on tines.com](https://www.tines.com/stories/docs/admin/connecting-tines-to-3b/)*

> **INFO:**
> Available to tenant admins. Requires an admin account on both your Tines tenant and the 3B instance.
> 
> The 3B connection lets Tines call 3B on your behalf. OAuth sets up the connection; OpenID Connect (OIDC) handles ongoing auth, so no long-lived API key is stored, Tines mints short-lived signed tokens that 3B verifies against Tines' public keys.

## Connecting to 3B

1. Go to **Admin settings → 3B connection**.
2. Enter your 3B instance URL (and a client ID if your 3B instance needs one).
3. Select **Connect** and authorize in 3B.
4. Approving provisions a service account, OIDC provider, and federation in 3B, and records the connection in Tines.
5. You return to Tines and the page shows **Connected**.




![](https://www.datocms-assets.com/55802/1785162980-screenshot-2026-07-27-at-15-32-28.png)

## Connection status

The page shows:

- **Status:** `Connected` or `Reconnect required`.
- **3B URL:** the connected instance.
- **Service account:** the 3B account Tines authenticates as.
- **Connected on:** the date it was established.

## How ongoing authentication works

Tines acts as the OIDC issuer for the connection: it publishes public signing keys, mints a short-lived signed token per call, and 3B verifies it against those keys. No shared secret is stored on either side.

## Reconnecting

If the page shows **Reconnect required**, open the **3B connection** page and select **Reconnect**, then authorize again. This re-establishes trust and clears the warning.

> **WARNING:**
> ## Self-hosted: changing your instance's domain
> 
> Tines is the OIDC issuer, so the connection is tied to your instance's address. For cloud, domain changes and the connection healing are handled by Tines automatically.
> 
> For self-hosted, Tines re-registers the connection automatically when it detects the address has changed:
> 
> -   -   On the next restart after the change, a startup check re-registers any connection whose issuer no longer matches the current address. (A change made through the supported domain-update flow also re-registers immediately, in-band.)
>     -   Keep the old domain reachable until re-registration finishes, it authenticates using the old issuer.
>     -   If it doesn't succeed, the page shows Reconnect required and an admin reconnects to restore it.
>     -   You cannot remove the old domain while the connection is still registered against it. Reconnect to the new domain first, then remove the old one.

## Creating 3B service accounts for teams in Tines

> **INFO:** Tenant admins can also create a 3B service account for a Tines team. This lets the team view webhooks and webpages from 3B Spaces in the Case actions menu and on the Case notification webhook selection page.

1. Go to **Admin settings → 3B connection**.
2. Select **Add Team service account**.
3. Select a Tines Team for the service account.
4. Select the 3B spaces that the service account should have access to.
5. Select **Connect team.**

> **NOTE:** You may need to re-authorize in 3B when you add a team service account to a space with skills or connectors it can't yet access.

**Connecting creates a service account in 3B that acts on behalf of the Tines team.**

![](https://www.datocms-assets.com/55802/1785230789-capture-d-ecran-2026-07-28-a-10-26-15.png)