What is the best way for mutual authentication of devices belonging to the same organization?

Tokens are typically used for user-based authentication sessions and are not well-suited for automated, persistent mutual authentication between devices at scale.

Digital certificates, issued by a trusted internal Certificate Authority (CA), enable mutual TLS (mTLS) authentication where both devices present and validate each other's certificates cryptographically. This is scalable, automated, and does not require human intervention, making it ideal for machine-to-machine authentication within an organization. PKI-based certificates provide strong identity assurance tied to the organization's trust hierarchy.

User IDs and passwords are designed for human authentication, are difficult to manage securely across many devices, and do not natively support the mutual (two-way) authentication model required between devices.

Biometric authentication requires a human biological trait as input and cannot be applied to device-to-device authentication scenarios where no human is present.