American Tire Distributors Holdings Authentication

generated: '2026-09-02'
method: searched
source: >-
  https://help.flxpoint.com/en_US/automotive-part/american-tire-distributors-as-a-source
  (Flxpoint integration guide, 302 -> flxpoint-p.helpjuice.com, HTTP 200);
  https://dataheretothere.com/2024/11/23/connecting-atd-american-tire-distributors/ (HTTP 200);
  https://www.sparkshipping.com/integrations/american-tire-distributors;
  plus live probes of https://atdonline.com/login (200) and https://customer.atd-us.com/ (200).
note: >-
  American Tire Distributors DOES operate a real partner API - integration platforms
  (Flxpoint, Spark Shipping, InfiPlex, Finale Inventory, X-Cart, Data Here-to-There) all ship
  a first-class ATD connector - but ATD publishes NO public developer portal, NO reference
  documentation and NO machine-readable contract. Everything below is reconstructed from those
  third-party integrator guides, which are consistent with each other; it is second-hand
  evidence and is labelled as such. ATD's own documentation is issued only to registered
  dealers, and credentials are provisioned by an ATD representative by email
  (integrator guidance names an @atd-us.com contact). No securityScheme could be derived
  because no OpenAPI exists in this repo or on any ATD host.
docs: null
docs_status: not-published
api_documented_publicly: false
credential_issuance:
  process: manual
  detail: >-
    Requester must already be a registered ATD dealer (apply at https://atdonline.com/register).
    API key and secret are issued by an ATD representative; there is no self-service key page
    on any public ATD host.
  self_service: false
  signup_url: https://atdonline.com/register
schemes:
  - id: atd-api-key-secret
    type: apiKey
    confidence: medium
    in: unknown
    parameter_name: unknown
    description: >-
      Every integrator guide instructs the operator to enter an "API key" and a "secret"
      supplied by ATD. The transport placement (header vs query vs body) is not stated in any
      public source, so it is recorded as unknown rather than guessed.
    evidence: >-
      Flxpoint: "input the API key, secret, and any other required information provided by ATD".
    scopes: []
environments:
  - name: sandbox
    purpose: >-
      ATD requires a successful test order placed in Sandbox, and confirmed by ATD, before it
      will enable Production ordering for an integration.
    self_service: false
    published_test_values: none
    evidence: Flxpoint / Data Here-to-There integration guides.
  - name: production
    purpose: Live catalog, inventory, pricing, dropship ordering and shipment tracking.
    self_service: false
    gated_by: ATD confirmation of the sandbox test order.
oauth2: false
openid_connect: false
mutual_tls: unknown
corporate_identity:
  note: >-
    Recorded for completeness and explicitly NOT an API auth surface. ATD's employee and
    customer-portal SSO runs on an Okta tenant (https://atd.okta.com); customer.atd-us.com
    (ServiceNow) 302s unauthenticated requests into an Okta SAML flow. The discovery documents
    served at atd.okta.com are Okta platform defaults describing Okta's own management API,
    not an ATD contract - see well-known/american-tire-distributors-holdings-well-known.yml.
  identity_provider: Okta
  protocols_observed:
    - SAML 2.0
    - OpenID Connect
  evidence_url: https://customer.atd-us.com/.well-known/openid-configuration
  evidence_status: 302
gaps:
  - No public API reference or getting-started page on any atd.com / atdonline.com host.
  - No OpenAPI, Swagger, GraphQL SDL, AsyncAPI, WSDL or .proto discoverable on any ATD host.
  - Key placement, token lifetime, rotation policy and error responses are all undocumented publicly.