Ask HN: How are you doing S2S authentication?

Hi everyone,

How are you doing service-to-service authentication in your apps? I'm looking for data about what people are using to secure calls between their own components. OAuth 2.0, SSH keys, mutual TLS with PKI, cert thumbprints, passwords, others? Why? How do you handle operational issues like revocation, keyroll, key distribution, and so on? Are there any particular libraries or services you use?

I work on identity at Microsoft and want to make sure we're thinking about what people really using.

Thanks!