so, how do you handle api authentication when you're dealing with microservices? what's your go-to strategy

Hey everyone, I'm trying to nail down a consistent and secure way to handle authentication across our microservices. We've been looking at JWTs, OAuth2, and even API keys, but each seems to have its own set of trade-offs. How are you all managing this? Any recommendations on balancing security with developer experience?