DMS · US and Canada

Tekion ARC user access, set up and removed across every store.

StitchOps gives new hires their Tekion ARC access the day HR adds them and removes it the moment they leave, at every rooftop. It checks every month who can still log in, pulls the reports your controller needs, and keeps a record of every step.

Book a free workflow audit Get a demo

All supported dealer systems →

What's hard about Tekion ARC today.

Tekion ARC runs in the cloud, so staff can reach it from anywhere, not just from a computer at the store. That makes a late removal riskier: a former salesperson at home can still open deals and customer records until somebody takes their access away. Groups moving stores onto Tekion also end up with users in two systems at once.

What StitchOps does in Tekion ARC.

Access removed the moment they leave

When HR marks someone as gone, StitchOps removes their Tekion ARC access at every store, so a login from home after their last day does not work.

New hires set up by job

A new salesperson, service advisor or F&I manager gets the Tekion ARC access their job needs, the same day HR adds them.

Help while you switch DMS

If some stores are moving to Tekion and others are not, StitchOps removes a person from both the old DMS and Tekion ARC, so nobody slips through during the move.

Monthly check of who can log in

StitchOps pulls the Tekion ARC user list at each rooftop, compares it to who works there, and flags anyone who should not have access.

Reports pulled for the controller

StitchOps downloads the Tekion ARC reports your controller pulls by hand and saves them where they are expected, on the schedule you set.

Before and after.

The manual wayWith StitchOps

Someone leavesAccess stays open, and reachable from home, until someone gets to it.Removed at every rooftop the moment HR marks them gone.

Store moving to TekionUsers tracked in two systems on two spreadsheets.One task removes or adds access in both systems.

Monthly access checkSkipped, because there is no time.User lists pulled at every store and compared to who works there.

Month end reportsDownloaded store by store by the controller.Downloaded on a schedule and saved where expected.

What Okta covers for Tekion ARC, and what StitchOps adds.

Okta signs users in and manages accounts where the app supports it in the Okta Integration Network. StitchOps covers the rest of the Tekion ARC account lifecycle.

Not in the Okta Integration Network.

StitchOps covers 8 of 8 capabilities for Tekion ARC.

What Okta covers for Tekion ARC, and what StitchOps adds
Capability	Okta, from the OIN	StitchOps
Single sign on	No SAML or OIDC in the OIN.	Enterprise password management signs users in to Tekion ARC with vaulted credentials. Users never need the password.
Shared accounts and MFA	Not part of the OIN listing.	Shares Tekion ARC logins and their MFA across a team, with credentials kept in your vault.
Joiners	No account creation in the OIN.	Creates the Tekion ARC account with the right role on day one, anywhere a person can log in and act.
Movers	No account updates in the OIN.	Changes Tekion ARC roles and access when someone changes jobs, anywhere a person can log in and act.
Leavers	No deprovisioning in the OIN.	Removes Tekion ARC access the day someone leaves, anywhere a person can log in and act, and saves evidence of the removal.
Password rotation	No password rotation in Tekion ARC.	Changes the Tekion ARC password on a schedule and the day someone leaves, and updates your vault in the same run.
Access reviews	No connector to read or remove Tekion ARC accounts.	Pulls the Tekion ARC user list on a schedule, compares it to your directory, and removes what you approve.
Audit evidence	Nothing logged inside Tekion ARC.	Step level evidence for every action StitchOps takes in Tekion ARC.

Single sign on
Okta, from the OIN
No SAML or OIDC in the OIN.
StitchOps
Enterprise password management signs users in to Tekion ARC with vaulted credentials. Users never need the password.
Shared accounts and MFA
Okta, from the OIN
Not part of the OIN listing.
StitchOps
Shares Tekion ARC logins and their MFA across a team, with credentials kept in your vault.
Joiners
Okta, from the OIN
No account creation in the OIN.
StitchOps
Creates the Tekion ARC account with the right role on day one, anywhere a person can log in and act.
Movers
Okta, from the OIN
No account updates in the OIN.
StitchOps
Changes Tekion ARC roles and access when someone changes jobs, anywhere a person can log in and act.
Leavers
Okta, from the OIN
No deprovisioning in the OIN.
StitchOps
Removes Tekion ARC access the day someone leaves, anywhere a person can log in and act, and saves evidence of the removal.
Password rotation
Okta, from the OIN
No password rotation in Tekion ARC.
StitchOps
Changes the Tekion ARC password on a schedule and the day someone leaves, and updates your vault in the same run.
Access reviews
Okta, from the OIN
No connector to read or remove Tekion ARC accounts.
StitchOps
Pulls the Tekion ARC user list on a schedule, compares it to your directory, and removes what you approve.
Audit evidence
Okta, from the OIN
Nothing logged inside Tekion ARC.
StitchOps
Step level evidence for every action StitchOps takes in Tekion ARC.

Okta coverage from the Okta Integration Network, read October 10, 2026. Tekion ARC has no OIN listing. StitchOps for Okta →

SCIM and API tax

What Tekion ARC charges to automate accounts.

Tekion ARC does not publish whether SCIM provisioning is included or which plan it needs. Ask the vendor before you count on it, or price it with your own contract in the calculator.

Pricing notes

StitchOps directory entry. SCIM availability and pricing not yet verified.

Last verified 2026-10-06 (estimate). SCIM pricing for every app · Method

Estimate Tekion ARC and your other apps

Employees

Apps (up to 5)

Loading prices.

Tune it in the full calculator

Expected scenario, list prices, SSO required, default department shares.

Common questions.

Can StitchOps remove someone from Tekion ARC the same day they are let go?

Yes. When HR or your identity system marks someone as gone, StitchOps removes their Tekion ARC access at every store you choose and records each change.

We are in the middle of moving to Tekion. Can it cover both DMS systems?

Yes. The same task can remove a person from Tekion ARC at one store and from CDK, Reynolds or Dealertrack at another, and the monthly check shows them together.

Do you need our Tekion ARC admin password?

StitchOps uses the admin login kept in your password vault, such as 1Password or Keeper, or in the StitchOps vault. It is used only on a secure computer inside your network, and the AI never sees it.

Since Tekion is in the cloud, where does StitchOps do the work?

On a secure computer at your dealership or in your own cloud. It opens Tekion ARC the way your staff do, and the screens never leave that computer.

Is StitchOps a Tekion partner?

No. StitchOps is not affiliated with or endorsed by Tekion. It works in Tekion ARC the way your own staff do, with the logins you give it.

Does Tekion ARC support SCIM?

Tekion ARC does not publish it. Ask the vendor which plan includes SCIM provisioning before you rely on it.

Can Tekion ARC accounts be automated without upgrading?

Yes. StitchOps creates, changes and removes Tekion ARC accounts on the plan you already have, triggered by the events your identity provider already sends. It uses an API when one exists and works anywhere a person can log in and act when one does not.

Is Tekion ARC in the Okta Integration Network?

No. As of October 10, 2026, the OIN has no listing for Tekion ARC. Okta can sign users in only through a custom app if Tekion ARC supports SAML or OIDC, and has no connector to manage Tekion ARC accounts.

Can Okta deprovision Tekion ARC users?

Not through an OIN connector. StitchOps removes Tekion ARC accounts the day someone leaves, anywhere a person can log in and act, and saves evidence of each removal.

How do you rotate Tekion ARC passwords when someone leaves?

StitchOps logs in to Tekion ARC, sets a new password, confirms it took effect, and updates 1Password, Keeper or the StitchOps vault in the same run.

For your IT team

Where it runs: An agent runs an unattended desktop session on a dedicated worker VM in your environment, on Windows or macOS. It connects outbound only over TLS 1.2 or later. No inbound ports are opened.
Credentials: Credentials stay in your vault (1Password or Keeper) or in the StitchOps vault, encrypted with AWS KMS and resolved on the worker at run time. Models never see the values.
Identity systems: Changes in Okta, Entra ID or Active Directory can start a task. StitchOps carries them into dealer systems that have no SCIM or API. JumpCloud is supported through our joint program. StitchOps is listed in the Okta Integration Network.
APIs where they exist: Where a system offers an API, such as Authenticom DealerVault or Fortellis, StitchOps uses it. Everything else runs through browser or desktop automation, anywhere a person can log in and act.
Logs and telemetry: Every run keeps step level logs with status, timing and redacted results. Telemetry is content free: no field values, no personal data, no screenshots.
Security reviews: SOC 2 Type 2 audit completed. ISO 27001 certified. Penetration tested by a third party. The security packet is shared under NDA.
AI assistants: Approved tasks are available as MCP tools to Claude, ChatGPT and Copilot. Destructive actions need explicit confirmation.

Last updated October 2, 2026. Product names are trademarks of their respective owners. StitchOps is not affiliated with or endorsed by them.

See it run in your Tekion ARC.

Fifteen minutes on your top three manual jobs. We tell you which one to hand off first.