Which two methods are API security best practices?

Use tokens after the identity of a client has been established.

Use the same operating system throughout the infrastructure.

Use encryption and signatures to secure data.

Use basic auth credentials over all internal API interactions.

Use cloud hosting services to manage security configuration.