Any method to do 2FA when two backend systems communicates via web API?
Solution 1:
If a password is something the server knows, then a certificate might be something the server has.
Consider protecting your web based API using TLS with mutual authentication where also the client (as the other server is acting as a client here) is authenticated via TLS. This way the password is only ever exchanged if both ends have first authenticated using their certificates.