# ARA Labs

> Developer documentation for Almeida Racing Academy community applications.

Base URL: https://labs.almeidaracingacademy.com

The API provides ARA training-plan definitions for authenticated eligible Gold members, including Gold bundles/lifetime and Platinum. Desktop apps authenticate using ARA login transactions with S256 proof and browser code confirmation. ARA bearer sessions last 12 hours; no client secret is required by or distributed to the desktop app.

## Documentation

- [Developer guide](https://labs.almeidaracingacademy.com/docs): Human-readable getting started guide.
- [Markdown guide](https://labs.almeidaracingacademy.com/docs/api.md): Authentication status, request examples, simulator mappings, polling, and errors.
- [OpenAPI specification](https://labs.almeidaracingacademy.com/openapi.json): Machine-readable collection and detail contracts, with synthetic examples.

- [Runnable reference client](https://labs.almeidaracingacademy.com/docs/overlay-client.mjs): Node.js login, plan reads and sign-out without storing tokens.

## Integration constraints

Use ARA endpoints for challenge definitions. Garage61 team tokens and Outseta administrative credentials stay on the ARA server and must never be embedded in a desktop application. Follow the exact desktop login flow in the Markdown guide. The public client ID is ara-challenge-overlay. Create a transaction, show its user code, open its verification URI, and poll with the original verifier. The browser signs in on the main Academy website and returns to Labs; the desktop app does not handle the website cookie. A client ID is never an access token.

Fetch on startup and at most once every five minutes. Match iRacing IDs through platform_id after checking platform is iracing. Targets contain labels and lapTime in seconds. Missing car mappings are not permission to use every car. Weekly schedules and weather conditions are not guaranteed machine-readable fields. Personal results and live telemetry are outside this API's scope.