Maven Machines Authentication

generated: '2026-08-25'
method: searched
source: >-
  https://maven-machines.readme.io/docs/basic-concepts.md and
  https://maven-machines.readme.io/docs/standard-tms-integration.md (docs), reconciled against the
  securitySchemes declared in all 21 documents under openapi/
summary:
  types:
  - apiKey
  api_key_in:
  - header
  oauth2: false
  openid_connect: false
  mutual_tls: false
  http_basic: false
  http_bearer: false
schemes:
- name: api_key
  type: apiKey
  in: header
  parameter: apiKey
  description: >-
    A single per-fleet, per-environment key sent as the `apiKey` request header on every protected
    call. Maven states it plainly in the middleware documentation: "All protected endpoints require
    an API key in the `apiKey` request header", and "Your `apiKey` determines which Maven
    environment (dev, qa, staging, prod) receives the request." The truckload documentation adds
    that "the apiKey header authenticates and authorizes the request to submit trip data for a
    specific company" — so the key is the tenant selector as well as the credential.
  sources:
  - openapi/maven-machines-users-openapi.json
  - openapi/maven-machines-assets-openapi.json
  - openapi/maven-machines-company-locations-openapi.json
  - openapi/maven-machines-shipments-openapi.json
  - openapi/maven-machines-shipment-locations-openapi.json
  - openapi/maven-machines-linehaul-openapi.json
  - openapi/maven-machines-manifest-commands-openapi.json
  - openapi/maven-machines-planning-and-dispatch-openapi.json
  - openapi/maven-machines-workflow-openapi.json
  - openapi/maven-machines-messages-openapi.json
  - openapi/maven-machines-market-apps-openapi.json
  - openapi/maven-machines-smart-openapi.json
  - openapi/maven-machines-reports-openapi.json
  - openapi/maven-machines-rest-service-manual-openapi.json
  - openapi/maven-machines-aaa-cooper-middleware-openapi.json
  - openapi/maven-machines-averitt-middleware-openapi.json
  - openapi/maven-machines-bozzutos-middleware-openapi.json
  - openapi/maven-machines-reddy-ice-middleware-openapi.json
  - openapi/maven-machines-roy-miller-middleware-openapi.json
  - openapi/maven-machines-triple-s-steel-middleware-openapi.json
tenancy:
  model: key-scoped
  detail: >-
    The key binds a caller to one company. A 401 in the users specification is described as "This
    endpoint may only be executed for company 1". The planning-and-dispatch definition additionally
    templates the tenant into the server URL —
    https://integrations.mavenmachines.com/companies/{companyKey}/ — so a caller integrating
    against that definition supplies the company twice, once in the path and once implicitly
    through the key.
environments:
- name: production
  base_url: https://integrations.mavenmachines.com/
- name: staging
  base_url: https://integrations-staging.mavenmachines.com/
  note: Keys are not interchangeable between environments.
key_management:
  self_serve: false
  rotation_documented: false
  scopes: false
  expiry_documented: false
  detail: >-
    Maven publishes no key-issuance, rotation, expiry or revocation procedure, no scope or
    permission model on the key, and no self-serve developer signup. Keys are provisioned to
    contracted fleets. Driver-facing permissions (e.g. "Market App Access") are managed in the Maven
    Fleet Admin portal as user roles, not as API scopes.
public_endpoints:
- path: GET /
  service: reddy-ice middleware
  detail: '"GET / is public and does not require an API key." Health check only; returns "Hello World!".'
gaps:
- >-
  All 17 OpenAPI 3.0.0 documents DECLARE the apiKey scheme in components.securitySchemes but do NOT
  apply it at document level (`security` is null). Only the four 3.1.0 documents carry a top-level
  security requirement. A client generated from the 3.0.0 documents authenticates nothing by
  default — see overlays/ for the correction.
- No OAuth, OIDC or mTLS option for enterprise fleets; a single long-lived shared header key is the
  only credential.
- /.well-known/openid-configuration and /.well-known/oauth-authorization-server return 404 on every
  Maven host, including accounts.mavenmachines.com.