Connecting Tines to 3B

Last updated August 11, 2026Open markdown version

Connecting to 3B

Go to Admin settings → 3B connection.
Enter your 3B instance URL (and a client ID if your 3B instance needs one).
Select Connect and authorize in 3B.
Approving provisions a service account, OIDC provider, and federation in 3B, and records the connection in Tines.
You return to Tines and the page shows Connected.

Connection status

The page shows:

Status: Connected or Reconnect required.
3B URL: the connected instance.
Service account: the 3B account Tines authenticates as.
Connected on: the date it was established.

How ongoing authentication works

Tines acts as the OIDC issuer for the connection: it publishes public signing keys, mints a short-lived signed token per call, and 3B verifies it against those keys. No shared secret is stored on either side.

Reconnecting

If the page shows Reconnect required, open the 3B connection page and select Reconnect, then authorize again. This re-establishes trust and clears the warning.

Warning

Self-hosted: changing your instance's domain

Tines is the OIDC issuer, so the connection is tied to your instance's address. For cloud, domain changes and the connection healing are handled by Tines automatically.

For self-hosted, Tines re-registers the connection automatically when it detects the address has changed:

- On the next restart after the change, a startup check re-registers any connection whose issuer no longer matches the current address. (A change made through the supported domain-update flow also re-registers immediately, in-band.)
- Keep the old domain reachable until re-registration finishes, it authenticates using the old issuer.
- If it doesn't succeed, the page shows Reconnect required and an admin reconnects to restore it.
- You cannot remove the old domain while the connection is still registered against it. Reconnect to the new domain first, then remove the old one.

Creating 3B service accounts for teams in Tines

Go to Admin settings → 3B connection.
Select Add Team service account.
Select a Tines Team for the service account.
Select the 3B spaces that the service account should have access to.
Select Connect team.

Connecting creates a service account in 3B that acts on behalf of the Tines team.