I’ve used client-side certs at a reasonable scale for API’s. The only downside I saw, setting up an internal CA and no matter how many warnings you send someon

I’ve used client-side certs at a reasonable scale for API’s. The only downside I saw, setting up an internal CA and no matter how many warnings you send someone will always forget to renew the cert at some point. They work really well and I think the only reason we don’t see them more is simply because your favourite http library likely didn’t support them. They are far simpler than JWT for auth. I think for internal service-service x.509 would be my preference. Also if writing internal web applications they’d be a good choice as can issue users certs and they get sso.