How do you handle authentication for gRPC calls, and how does it differ from typical REST API authentication patterns?

gRPC supports the same underlying mechanisms as REST (JWT bearer tokens, mutual TLS/client certificates) but transmits credentials via gRPC metadata (analogous to HTTP headers) rather than traditional HTTP headers directly in application code -- ASP.NET Core's standard authentication/authorization middleware ([Authorize] attributes, JWT bearer validation) works identically for gRPC services since they run on the same underlying ASP.NET Core pipeline, while gRPC clients attach credentials via CallCredentials or metadata added to each call.

// Server: same [Authorize] attribute works identically for gRPC services
[Authorize]
public class SecureService : Secure.SecureBase {
    public override Task<Response> GetData(Request request, ServerCallContext context) { ... }
}

// Client: attaching a bearer token via call credentials
var credentials = CallCredentials.FromInterceptor((context, metadata) => {
    metadata.Add("Authorization", $"Bearer {token}");
    return Task.CompletedTask;
});