HMAC vs OAuth2.0 for AI API authentication: enterprise security tradeoffs compared