HMAC-SHA256 vs OAuth2.0: choosing authentication for AI Agent calling LLM APIs