That is correct. However, using and maintaining client certificates is a huge pain, especially for a massively multitenant service such as Heroku. HTTP Basic A

That is correct. However, using and maintaining client certificates is a huge pain, especially for a massively multitenant service such as Heroku. HTTP Basic Auth is quite a bit simpler as an authentication mechanism and, over TLS, is sufficiently secure.