The Internet of Drones (IoD) will have revolutionized civil and commercial applications, in much the similar way that the Internet of Things (IoT) transformed the way information is exchanged with other devices and systems over the Internet. The drones are generally considered to have constrained resources, which make them less compatible with complicated algorithms and more prone to attacks. Moreover, the IoD applications are facing information security and privacy challenges in the cyber-threat environment, where the adversary could intercept communicating messages and compromise their confidentiality or integrity. Consequently, the security protocols which are designed for IoD applications should not only provide desirable security guarantees, but also be resource-efficient. Existing authenticated key exchange protocols can authenticate the identities of communication parties and realize the exchange of session key, however, they either incur high communication overhead, suffer from non-negligible computational cost, or have inherent security design flaws. Thus, these approaches are not suitable for resource-constrained drones involved in critical IoD applications. To address the above challenges, this paper presents a featherweight authentication and key agreement scheme (hereafter referred to as fwAKA) for IoD applications based on elliptic curve cryptography, physical unclonable function, hash function, and XOR operation. The fwAKA only requires two handshakes to achieve authenticated key agreement. We prove that the fwAKA is perfectly secure in the adversarial setting through the security verification using the AVISPA. We set up a simulation environment, implement the fwAKA and its counterparts, and conduct performance evaluation in terms of communication overhead and running time. Experimental results indicate that not only is the fwAKA robust against well-known attacks but also it is more resource-efficient than its opponents.