TLS client certificates are even easier, don&#x27;t require consuming party (the server) to know private key at all, and are reasonably secure.<p>They are not working for end users, because no browser ever cared about those (UI&#x2F;UX-wise), but I don&#x27;t see any reason to not use those for automated access by IoT stuff. Generate keypair on-device, send a CSR, ask user to open browser and check if device&#x27;s theirs (by comparing a conveniently formatted fingerprint - as a picture and&#x2F;or series of dictionary words, not hex digits), sign and use if everything&#x27;s good.