Certificate

Classic SharePoint REST (_api/web/...) with app-only auth only accepts certificate-based tokens. Here's how to set up a Sites.Selected app registration, prove it with a throwaway cert, and run it in production with a Key Vault-managed, auto-renewing certificate.