Avery Dennison Authentication

generated: '2026-09-18'
method: probed
source: https://login.atma.io/.well-known/openid-configuration
docs: null
summary: >-
  The atma.io connected product cloud API (audience https://open.atma.io) is gated by OAuth 2.0 /
  OpenID Connect issued from an Auth0 tenant on the provider's own custom domain, login.atma.io.
  The documentation portal docs.atma.io itself redirects anonymous visitors into that authorization
  flow (authorization code + PKCE S256, scopes openid profile email offline_access), so no public
  authentication guide, API-key scheme or scope reference could be read. The profile below is what
  the identity provider publishes about itself; API-level scopes for open.atma.io are undocumented.
schemes:
- name: atma-oauth2
  type: oauth2
  issuer: https://login.atma.io/
  flows:
    authorizationCode:
      authorizationUrl: https://login.atma.io/authorize
      tokenUrl: https://login.atma.io/oauth/token
      refreshUrl: https://login.atma.io/oauth/token
      pkce: S256
    deviceCode:
      deviceAuthorizationUrl: https://login.atma.io/oauth/device/code
      tokenUrl: https://login.atma.io/oauth/token
  audience: https://open.atma.io
  identity_scopes: [openid, profile, offline_access, name, given_name, family_name, nickname, email, email_verified, picture, created_at, identities, phone, address]
  api_scopes: undocumented
  token_endpoint_auth_methods: [client_secret_basic, client_secret_post, private_key_jwt, none]
  jwks_uri: https://login.atma.io/.well-known/jwks.json
  dynamic_client_registration: https://login.atma.io/oidc/register
  evidence:
  - url: https://login.atma.io/.well-known/openid-configuration
    status: 200
  - url: https://docs.atma.io/
    status: 302
    note: redirects to https://login.atma.io/authorize?...&audience=https%3A%2F%2Fopen.atma.io&code_challenge_method=S256
- name: developer-portal-okta
  type: openIdConnect
  issuer: https://averydennison.okta.com/oauth2/v1
  note: >-
    developer.averydennison.com is a Vouch-proxied portal whose every path 302s to an Okta
    authorization request (scope openid email). This gates the portal, not an API; it is recorded
    so the wall is on record.
  evidence:
  - url: https://developer.averydennison.com/developers/
    status: 302