One of our security mandates require authentication between servers when transmitting data. These API endpoints are only accessible within the internal network and are never exposed.
Our idea is to user a single token authentication scheme. We will have a token pair between the internal servers and with each request, the calling server will submit the token in the request header over HTTPS to the target server. The target server will authenticate the token to see if it matches and if does, it processes the request. If it doesn't, it logs the invalid connection attempt.
We feel implementing OAUTH 2.0 or similar would be overkill seeing as its internal, we control both servers, there is a small group of people with access and it will be over HTTPS.
Is this an acceptable solution? The token will be generated using a secure random function and stored on each server with access right locked down. The token won't expire as it's not meant for users but for the servers.