What is mTLS?
In short:mTLS, mutual TLS, means both sides of a connection present certificates, so the server knows exactly which client it is talking to. Tokens can be bound to the client certificate. It is a well-tested way to authenticate agents running as services and to stop stolen tokens being replayed elsewhere.
How does it work?
The client presents a certificate during the TLS handshake. The authorization server records the certificate thumbprint in the token.
What does it look like in practice?
Descope lists mTLS among its supported agent authentication methods.