How do backend services authenticate (M2M)?

With the OAuth 2.0 client-credentials grant — no user in the loop. The resulting access token acts within one tenant only and carries only the capabilities granted by the roles bound to that client.