JWTs are a good approach. I've also seen folks using mTLS with gRPC.