Is client certificate mandatory for two-way TLS?

Question

In One-way Transport Layer Security (TLS), client who initiates the connection verifies the identity of the server or entity it is connecting to, but server not necessarily validates client identity.

In Two-way TLS connections, both client and server validates each other's certificate (public key) to achieve mutual authentication. The question here is, does the client necessarily send its certificate? What if the client sends a credentials (E.g token/API key) that the server knows and validates to verify the identity, is this not a mutual authentication and two-way TLS? I do understand certificates are a better way of proving identity than token/secret.

Answer 1

Strictly speaking, there is no such specification as "two-way TLS". It is rather an informal expression. It means a TLS connection with mutual authentication based on PKI.

If you use anything else for client authentication, but not TLS/SSL certificates, then it is not a two-way TLS. I'd suggest to use other words, because improper wording leads to misunderstanding and wrong expectations of all people involved: customers, developers, testers, auditors, etc.

To your questions:

does the client necessarily send its certificate?

Yes. Otherwise it is not a "two-way TLS".

What if the client sends a credentials (E.g token/API key) that the server knows and validates to verify the identity, is this not a mutual authentication and two-way TLS?

It is not a "two-way TLS". It does not mean that it is better or worse for particular purpose. It just means we cannot call it "two-way TLS".