API Authentication

API keys, Basic auth, Bearer tokens (opaque vs JWT), HMAC request signing, mutual TLS, refresh-token rotation, scoped permissions …