We should at least add support for an authorization header in the REST/gRPC clients. Beyond this, support for negotiating access tokens as described at https://developers.google.com/identity/protocols/OAuth2 and other auth, e.g. JWT, would be nice to have. We probably need the full auth flow if we want to maintain persistent connections beyond the lifetime that a static token would provide for.