Authentication with Applications

How should we ensure that Applications are authorised to connect to an instance of PEDASI?

Possibilities:

PEDASI generates key that the application must present when connecting for the first time
Signed JWT

Please add any additional possibilities below