How do you implement service-to-service authentication in a Node.js microservices architecture, so internal services can trust requests from each other?

Common approaches include mutual TLS (mTLS, where each service presents a certificate verified by the other, providing strong cryptographic identity for both sides of the connection), service-specific API keys or client credentials (each service authenticates using its own credentials, often via the OAuth 2.0 client credentials grant), or, within a service mesh, having the mesh's sidecar proxies automatically handle mTLS transparently without the application code needing to implement it directly at all.

// OAuth client credentials grant for service-to-service auth
async function getServiceToken() {
  const response = await fetch('https://auth.internal/token', {
    method: 'POST',
    body: new URLSearchParams({
      grant_type: 'client_credentials',
      client_id: process.env.SERVICE_CLIENT_ID,
      client_secret: process.env.SERVICE_CLIENT_SECRET,
    }),
  });
  return (await response.json()).access_token;
}