The TreadReady Gateway.
The Gateway is the integration layer partners, agents, and dealer websites use to work with the TreadReady platform — products, orders, inventory, warranty claims, telematics, and EDI. One base URL, three key types, and the same org-scoped resource layer behind REST and MCP.
Base URL
https://middleware.treadready.comLiveness check (no auth required): GET /healthz → { "ok": true, "service": "tread-sync-gateway" }
Key types
Secret API key
trk_live_…REST /v1/* and MCP /mcp, sent as Authorization: Bearer.
Portal key
pk_portal_dealer_…Dealer-site embeds against /api/portal/v1/*, sent as X-Portal-Key.
Connect token
ct_…Fleet self-serve telematics connect, posted once to /connect.
Authentication (REST + MCP)
Every /v1/* request and the /mcp endpoint use the same header. Keys are issued by the platform operator with a one-time reveal — only a SHA-256 hash is stored. Keys can expire, be deactivated, and carry scopes.
Authorization: Bearer trk_live_XXXXResponse envelope
// success
{ "ok": true, ...payload }
// error
{ "ok": false, "status": 403, "error": "missing scope: orders:write" }Rate limits
Each API key has a per-minute sliding-window rate limit and returns 429 when exceeded. Dealer portal keys are additionally limited per key and per IP, and the public telematics connect endpoint allows 10 requests per minute per IP with a 16 KB body limit.