OAuth2: how to authenticate the Authorization Server itself?

Question

OAuth

Let's say that the OAuth2 Authorization Server is being developed as a separate application (in the form of a Reverse Proxy that checks the Access Token and forwards the request to a separate Resource Server).
Let's say both the Authorization Server and the Resource Server are hosted on the public Cloud (for example, as 2 separate applications in Heroku), and are accessible from the Internet.
Question: What is the best way to ensure that only the Authorization Server (as a trusted application) can connect and use the Resource Server?
Ideally, without using heavy dependencies in the Resource Server (such as Spring Security).
Client Authentication via Client Certificate is out of the question - Heroku does not support this method.
VPN is also impossible to provide between applications in the public Cloud.

Answer 1

I considered Digest - but for some reason, sha256 in Spring Security requires additional configuration (insecure md5 is used by default), this somehow warns me against tying the solution to Digest authorization.