mTLS

Normal HTTPS usually proves:
Server → Client: “I am api.company.com.”

But perhaps the server also needs strong cryptographic proof of which client is connecting.

Both sides present and prove possession of keys associated with certificates.

Client certificate → Server
Server certificate → Client

Both identities can be authenticated during TLS establishment. For ordinary public websites, mTLS is uncommon. It is common in controlled environments, such as communication between services, corporate applications, and managed devices, where both sides have certificates.