API auth: JWT vs signed API key — which for a server-to-server integration?

For pure server-to-server we recommend signed API keys with HMAC — no token refresh dance, easier to rotate. JWT is for cases where you're forwarding a user identity.