Authentication is not specified by the ActivityPub standard. In practice, the fediverse mostly uses HTTP Message Signatures to authenticate server-to-server requests, using a relatively consistent profile. This document describes that profile and usage, recommends best practices, and evaluates their success so far.

(no)

Tedu's implementation of HTTP signatures which is used in, for example, Honk. Since it's written in Go, is actually used, and licensed under a free license, I'll probably use it for Betula.

Info on HTTP signatures.