The "best" answer depends on your server arrangement, your threat model, your security model, your vulnerability profile, your maintenance program, and dozens of other factors.
Essentially you're asking "what is the best authentication mechanism?" -- to which the answer clearly is, "no."
But let me throw out some options:
- Shared secret with digest-based authentication
- Digest-based secret storage with plaintext authentication
- Certificate-based authentication with a single trusted signing certificate
- Certificate-based authentication with explicit trust of all allowed certificates
- Certificate-based authentication with a global PKI
- IP-based trust with no authentication
- IP-based trust in addition to authentication
- Requests tunneled over an authenticated channel (e.g. SSH)
- Requests passed over a VPN in addition to or in lieu of any of the above
And I could keep going if I had the patience for it. Each system has its place, and I could come up with a compelling situation where any of the above is appropriate, and a compelling situation where any of the above is wildly inappropriate.
It all depends.