In a monolith, trust is implicit. With two services, you must prove it. ZeroTrust API assumes the network isn't safe.
mTLS by default
Every service presents a client certificate; the other verifies it. No fragile IP allow-list, no shared secret in the URL.
Short JWTs
Access tokens live a few minutes and renew. An intercepted token only opens a tiny window — and replay is blocked by nonce.
The manageable PKI
The usual objection: « a PKI is hell to operate ». True if you build it yourself. Here, a lightweight local CA + automatic service-cert rotation is enough. The perimeter is small, the audit is real.