Acres Manufacturing Authentication

generated: '2026-09-06'
method: searched
source: >-
  https://acresmanufacturing.com/faq/ ("Is Foundation secure? All Foundation network communication
  utilizes the latest encryption standards (TLS 1.3). Furthermore, APIs require mTLS for
  authentication.") and
  https://github.com/acres4/foundation-documentation/blob/master/apis/event/1.4/usage.md
docs: https://acresmanufacturing.com/faq/
summary: >-
  Acres states publicly that Foundation APIs authenticate with mutual TLS. The Foundation Event
  Replay API reference itself documents no credential, header, token or handshake — it shows only
  the WebSocket URL and its query filters — so a partner obtains and installs a client certificate
  through the casino property and Acres, not through a self-service developer portal. There is no
  OAuth, no OpenID Connect, no API key and no published key-issuance flow.
schemes:
- type: mutualTLS
  name: Client certificate (mTLS)
  in: transport
  described_in: provider FAQ
  described_in_contract: false
  evidence: >-
    "APIs require mTLS for authentication" — https://acresmanufacturing.com/faq/
  note: >-
    The mechanism is asserted on the marketing FAQ, not in the API reference. Certificate issuance,
    rotation, revocation and the trust anchor are undocumented publicly.
transport_security:
  tls: 'TLS 1.3'
  evidence: https://acresmanufacturing.com/faq/
oauth2: false
openid_connect: false
api_key: false
basic_auth: false
scopes_published: false
self_service_signup: false
onboarding: >-
  Access is granted per property. The consumer connects to their own casino's Foundation host
  (wss://{property}.kailabor.com), which implies the operator provisions the partner rather than
  Acres issuing public credentials.
gaps:
- The API reference documents no authentication at all; the only statement is on the FAQ page.
- No certificate-issuance, rotation or revocation procedure is published.
- No documented error response for an authentication failure (the only documented error is HTTP 400 on a non-upgraded request).