Arcbest Authentication

generated: '2026-09-04'
method: searched
source: >-
  ArcBest's own published Expedite instructions
  (docs/arcbest-expedite-customer-quote-book-instructions-2024-08.pdf,
  docs/arcbest-expedite-tms-quote-book-instructions-2024-08.pdf), the ArcBest API access support
  article (https://support.arcb.com/en/articles/2851223-api-access), and live probes of api.arcb.com
  on 2026-09-04.
provider: ArcBest
providerId: arcbest
summary:
  types:
    - http
  self_serve: false
  note: >-
    ArcBest runs two different authentication schemes on two different Expedite products. Neither is
    OAuth 2.0 and neither is self-serve - every credential is issued by a human at ArcBest.
schemes:
  - name: bearerAuth
    type: http
    scheme: bearer
    api: arcbest:arcbest-expedite-customer-api
    description: >-
      Customer API. POST {"ClientId": "<32 chars>", "ClientSecret": "<64 chars>"} to
      https://api.arcb.com/expedite/customer/authorize; the response is
      {"AccessToken": "<~1000 chars>"}. Send that token on every subsequent call as
      `Authorization: Bearer <accesstoken>`. ArcBest states "The API uses standard bearer
      authentication".
    token_endpoint: https://api.arcb.com/expedite/customer/authorize
    test_token_endpoint: https://test.api.arcb.com/expedite/customer/authorize
    credential_issuance: ArcBest support (api@arcb.com). Not self-serve.
    token_lifetime: not published
    refresh: not published
    scopes: none published
    sources:
      - docs/arcbest-expedite-customer-quote-book-instructions-2024-08.pdf
      - docs/arcbest-expedite-customer-api-definition.html
    evidence:
      - url: https://api.arcb.com/expedite/customer/authorize
        status: 405
        note: GET returns Method Not Allowed - the endpoint is live and POST-only. Probed 2026-09-04.
  - name: basicAuth
    type: http
    scheme: basic
    api: arcbest:arcbest-expedite-tms-api
    description: >-
      Third Party TMS API. HTTP Basic with a username and password issued by the ArcBest Expedite
      team. "Request basic authentication username and password from the ArcBest Expedite team."
    credential_issuance: ArcBest Expedite team. Not self-serve.
    sources:
      - docs/arcbest-expedite-tms-quote-book-instructions-2024-08.pdf
      - docs/arcbest-expedite-tms-api-definition.html
    evidence:
      - url: https://api.arcb.com/expedite/digital/
        status: 401
        note: 'Returns a WWW-Authenticate header of `Basic realm="service"`. Probed 2026-09-04.'
      - url: https://test.api.arcb.com/expedite/digital/
        status: 401
        note: Same Basic challenge on the test host. Probed 2026-09-04.
account_api_id:
  detail: >-
    Separately from the Expedite APIs, an existing arcb.com customer has an "API ID" visible after
    signing in - Menu > Resources > APIs at https://arcb.com/api, which 302s to
    https://arcb.com/login?m=login-required for anonymous callers. That surface (rate quote, volume
    quote, tracking, document retrieval, transit times, pickup request, bill of lading) is documented
    only behind that login; its authentication scheme is not published anywhere anonymous.
  evidence:
    - url: https://arcb.com/api
      status: 200
      note: Redirects to https://arcb.com/login?m=login-required. Probed 2026-09-04.
    - url: https://support.arcb.com/en/articles/2851223-api-access
      status: 200
oauth:
  supported: false
  detail: >-
    No OAuth 2.0 or OpenID Connect. No /.well-known/oauth-authorization-server or
    /.well-known/openid-configuration is served on arcb.com, api.arcb.com, test.api.arcb.com or
    www.arcbest.com - all 404, probed 2026-09-04. See well-known/arcbest-well-known.yml. No scopes
    artifact is emitted because no scopes exist to record.
mtls:
  supported: false