TLS allows for client certificate validation. Client certificates can be signed by the client, the service provider, or a trusted third-party CA. I'm talking about the middle option.
At a glance, it would seem to me that handing out an API key to a client would be equally (in)secure to identify that client, as when signing a CSR for that client on the service provider. The API key approach would be a LOT simpler, not having to deal with CSRs and certificate renewal etc.
Are there any differences in security between these two options?
I have to also mention here that there is complete control over client implementation, i.e. safeguarding the API key client side is under the same level of control as the client's certificates and private key