In the Internet of Things (IoT) domain, it is vital to achieve secure and lightweight authentication because of the limited availability of computational, storage, and energy resources on smart devices. In this paper, a new PUF-based authentication protocol specifically tailored to tackle such constraints is proposed. Levying the native randomness and individuality of PUFs, the protocol enables safe authentication and identity verification among servers and IoT devices without relying on computationally expensive cryptographic operations. To find its robustness, the new protocol is analytically verified using the AVISPA verification tool and is certified immune to the most common security attacks such as replay, man-in-the-middle, and impersonation attacks. Additional performance analysis offers an end-to-end performance comparison and confirms that the protocol indeed optimizes communication and computation overhead along with offering strong security assurance. These results confirm that the provided solution is best suited for its implementation in real IoT networks where efficiency as well as security is a requirement.