We implemented a CA/client-cert based authentication, and decided to not do it again. - Users are used to just getting public/private API keys, and it's often

We implemented a CA/client-cert based authentication, and decided to not do it again. - Users are used to just getting public/private API keys, and it's often common knowledge how to store the private key securely. - Tooling is surprisingly scarce. Not all API testing tools support client certificates, and users didnt want to do the openssl dance. - Users kept forgetting the certification expiration date. We had to remind them to do the openssl dance again every 3 months. - for the server side, unit testing was a bit complicated because the TLS implementation was supposed to be a separate later from the actual application.