Multiple auth schemes for single API definition

I’m afraid that isn’t supported.

Tyk only allows one auth method per API definition.

You could use long-lived JWTs for the app-to-app though and have different rate limits attached to those using the embedded policy ID claim.