Device authentication?

Question

User identification

Good afternoon.

Some devices located in a public place need to be authenticated by the backend in order to be allowed to use the API. All Android devices. They can transmit either a MAC address or a serial code. This information will be used for authentication.

What's the best way to implement this safely and quickly? The use of the MAC address can immediately be discarded, as far as I understand. The serial remains.
There is an option to use JWT and check signatures, or just serial + secret.
I would be grateful for any suggestions.

Answer 1

1) API token for each account/device
2) Login + Password
The first option is preferable