## BambooHR integration

BambooHR is a cloud-based human resources platform that helps companies manage employees, time off, time tracking, payroll, benefits, performance, and training. The BambooHR integration with Frontegg allows your application to access employee data, time off requests, time tracking entries, files, goals, and company information on behalf of your users via the BambooHR REST API.

Prerequisites
- A BambooHR account with access to the [BambooHR Developer Portal](https://developers.bamboohr.com)
- An organization registered in the Developer Portal with permission to create applications


### Connect BambooHR

#### Step 1: Open the BambooHR Developer Portal

Go to [developers.bamboohr.com](https://developers.bamboohr.com) and sign in with your BambooHR developer account credentials. If multi-factor authentication is enabled, enter the 6-digit code from your authenticator app.

![BambooHR Developer Portal login page](/assets/bamboohr-1.8361d3bb3c362bbe86edf5096f0a1a9fb2e7c565d4272c8844cb09be0e3845a7.1ce25488.png)

#### Step 2: Create a new application

After logging in, you land on the **Applications** page of your organization. Click the **Add application** button in the top-right corner of the applications list.

![BambooHR Developer Portal applications list with Add application button highlighted](/assets/bamboohr-2.b9181ed559d05691291379be9ae37e7c5aa573b9c8e6e413b1d57f162be90876.1ce25488.png)

#### Step 3: Name the application

In the **New Application** dialog, enter an application name and click **Create Application**.

- **Application Name**: `Frontegg Integration`


![New Application dialog with application name filled in](/assets/bamboohr-3.f0dfc382f9fb75397326a8cc3dd65c7e9e1a7b371ccb9732e729ebaf15ed52bc.1ce25488.png)

#### Step 4: Copy your credentials

After the application is created, you are taken to the application detail page. Locate the **App Credentials** section to find your **Client ID** and **Client Secret**. Use the copy buttons next to each field to copy the values.

![BambooHR application detail page showing App Credentials section with Client ID and Client Secret](/assets/bamboohr-4.27a5e3c0702aecd9177db6aad8768f76c27d3b58a6fe03074839dc8db955d30a.1ce25488.png)

Save your Client Secret now
Copy the Client Secret immediately and store it securely. If you lose it, you will need to use the **Regenerate** button, which invalidates the previous secret.

#### Step 5: Configure redirect URIs

Click the **App details** button at the top of the page. In the **Application Details** dialog, add the Frontegg callback URL to the **Redirect URIs** field.

Enter the following redirect URI:

- `https://YOUR_MCP_GATEWAY_URL/integration-callback`


Click **Save Changes**.

![Application Details dialog with Frontegg callback URLs entered in the Redirect URIs field](/assets/bamboohr-5.dfd935138d95ffa1ca39b4e011e704ece2dfde7475aa6479497517172e424998.1ce25488.png)

#### Step 6: Open the scope selection dialog

Back on the application detail page, scroll to the **Application Scopes** section and click **Select Scopes**. The **Scope Selection** dialog opens, showing all available scope groups: Background Checks, Benefits, Claims, Company, Employee, Hiring, Miscellaneous, Payroll, Reports, Scheduling, Time Off, and Time Tracking.

![BambooHR Scope Selection dialog showing all scope groups](/assets/bamboohr-6.a2a8fb99c0bf5b3066d1ae51329c41bc75eb92ce52ebdbe8341ee075e03d8070.1ce25488.png)

#### Step 7: Configure access for the required scopes

Expand each scope group you need and set the access level for individual scopes. For each row, click the access toggle (**No Access**, **Read Only**, or **Read & Write**) to grant the required permission.

For the Frontegg BambooHR integration, configure access for the following scopes based on the features you plan to use:

| Scope group | Scope | Recommended access |
|  --- | --- | --- |
| Employee | `employee` | Read Only or Read & Write |
| Employee | `employee_directory` | Read Only |
| Employee | `employee:file` | Read Only |
| Time Off | `time_off` | Read Only or Read & Write |
| Time Tracking | `time_tracking` | Read Only |
| Training | `training` | Read Only |
| Miscellaneous | `goal` | Read Only |
| Company | `company:info` | Read Only |
| Company | `company_file` | Read Only |
| — | `openid` | Required for OpenID Connect sign-in |
| — | `offline_access` | Required to obtain a refresh token |


Take only what you need
Following the principle of least privilege, grant only the access levels your integration actually requires. You can always come back and adjust the scope assignments later.

![Employee scope group expanded showing the list of individual scopes with access toggles](/assets/bamboohr-7.74f2fdd11e186fb3c1530e1871dd55bc383e51f56a6c93757bd5a94405e821f4.1ce25488.png)

After configuring all required scopes, click **Save Changes** at the bottom of the dialog.

#### Step 8: Find your BambooHR subdomain

In addition to the OAuth credentials, the Frontegg integration needs your **BambooHR subdomain** — the unique company identifier in your BambooHR URL. If you sign in to BambooHR at `https://yourcompany.bamboohr.com`, your subdomain is `yourcompany` (without `https://` and without `.bamboohr.com`).

To find it, sign in to your BambooHR instance and open **Settings** → **Account** → **Account Info**. Your company URL is shown right under the company name — copy only the subdomain part.

![BambooHR Account Info page with the company URL highlighted](/assets/bamboohr-8.e5e9063d6a2d2f478a7eb5b83751572b712110f120d9b88a4b8be22c38047b2d.1ce25488.png)

### Configure the Frontegg portal

Once you have obtained your **Client ID** and **Client Secret** from the steps above, enter them in the integration configuration page of the Frontegg portal:

1. Open the **Frontegg portal** and navigate to [ENVIRONMENT] → Integrations → BambooHR.
2. Enter the **Client ID** and **Client Secret** in the corresponding fields.
3. Enter your **BambooHR subdomain** (e.g. `yourcompany`) in the **BambooHR subdomain** field.
4. Select the required **scopes**.
5. Click **Save**.


Keep your credentials secure
Never share or commit your Client Secret to version control.

### Additional resources

- [BambooHR API documentation](https://documentation.bamboohr.com/docs)
- [BambooHR OAuth 2.0 authentication guide](https://documentation.bamboohr.com/docs/getting-started)
- [BambooHR Developer Portal](https://developers.bamboohr.com)
- [How to get your Redirect URL](/agen-for-work/connectors/redirect-url)