The Internet of Things (IoT) is here, more than 10 billion units are already connected and five times more devices are expected to be deployed in the next five years. Technological standarization and the management and fostering of rapid innovation by governments are among the main challenges of the IoT. However, security and privacy are the key to make the IoT reliable and trusted. Security mechanisms for the IoT should provide features such as scalability, interoperability and lightness. This paper adresses authentication, authorization and access control in the frame of the IoT. It describes two technologies which, used in conjunction, provide all the credentials for secure authorization and access control in wireless constrained hardware systems with scalability and interoperability requirements. Physical Unclonable Functions (PUF) are lightweight cryptographic primitives that can be easily embedded in reconfigurable hardware. They provide secure, low-cost authentication means for constrained devices. Embedded Subscriber Identity Module (eSIM) provide cellular connectivity with scalability, interoperability and standard compliant security protocols. An authorization scheme involving a client, an authorization server and a constrained resource server is proposed based on PUF and eSIM features. Concrete IoT uses cases are discussed (SCADA and building automation).