Which mechanism provides stateless authentication and authorization for REST API calls?

OAuth 2 tokens provide stateless authentication and authorization for REST API calls because they are self-contained and carry all necessary information (like user identity and permissions) within the token itself, typically a JSON Web Token (JWT). The server doesn't need to store session state, making it scalable for distributed systems. API keys offer authentication but are generally less secure for authorization and often require additional mechanisms for user context. SSL/TLS certificate encryption secures the communication channel but doesn't handle authentication or authorization of the API caller. Cookie-based session authentication is stateful, as the server must maintain session information associated with the cookie.