REST API authentication patterns for external integrations

<p>I'm building an integration between Heratio and our institutional CMS. The ahgAPIPlugin provides webhook support, but I need to understand the authentication flow better.</p><p>Questions:</p><ol><li>What auth method is recommended for server-to-server communication?</li><li>Is there rate limiting on the API endpoints?</li><li>Can we use OAuth2 tokens from the registry login?</li></ol>