Is client certificate mandatory for two-way TLS?
Strictly speaking, there is no such specification as &quot;two-way TLS&quot;. It is rather an informal expression. It means a TLS connection with mutual authentication based on PKI.
If you use anything else for client authentication, but not TLS/SSL certificates, then it is not a two-way TLS. I'd suggest to use other words, because improper wording leads to misunderstanding and wrong expectations of all people involved: customers, developers, testers, auditors, etc.
To your questions:

does the client necessarily send its certificate?

Yes. Otherwise it is not a &quot;two-way TLS&quot;.

What if the client sends a credentials (E.g token/API key) that the
server knows and validates to verify the identity, is this not a
mutual authentication and two-way TLS?

It is not a &quot;two-way TLS&quot;. It does not mean that it is better or worse for particular purpose. It just means we cannot call it &quot;two-way TLS&quot;.