A Child's Garden of Inter-Service Authentication Schemes

Brian

Nothing at all
Bearer Token; e.g. browser cookies, API keys, simple password
HMAC(timestamp) / TOTP (Time-based One-time Password algorithm)
PAKE (Password-authenticated key agreement)
Encrypted Tokens
Macaroons; recommended by this blogger: provide both delegation and attenuation
Asymmetric Tokens
Mutual TLS: client provides a certificate signed by the host
SPIFFE: Secure Production Identity Framework For Everyone
Tokbind: bearer tokens combined with MTLS [Multiplexed Transport Layer Security]
Magic Headers
Kerberos

About