My team is working on web API project for one customer which will call this API. Now we are thinking about authentication. We've stopped on two options HMAC and client certificates
- pros - no expiration (just pair of client id and secret key),
- cons - complex logic for client to implement HMAC token.
- pros - simple for client (just attach client certificate to httprequest),
- cons - expiration, need to support of renewal of certificates.
Please help me with pros and cons here.