func CredStoreTokenInterceptor(publicKey crypto.PublicKey) grpc.UnaryServerInterceptor {
	return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
		var newCtx context.Context
		var err error
		md, ok := metadata.FromIncomingContext(ctx)
		if ok == false {
			return nil, grpc.Errorf(codes.Unauthenticated, "cannot read metadata for request")
		}
		tok := md["authorization"]
		if len(tok) != 1 {
			return nil, grpc.Errorf(codes.Unauthenticated, "bad authorization string")
		}
		if tok[0] == "" {
			return nil, grpc.Errorf(codes.Unauthenticated, "authorization header is missing")
		}
		splits := strings.SplitN(tok[0], " ", 2)
		if len(splits) < 2 {
			return nil, grpc.Errorf(codes.Unauthenticated, "bad authorization string")
		}
		if strings.ToLower(splits[0]) != strings.ToLower("bearer") {
			return nil, grpc.Errorf(codes.Unauthenticated, "request unauthenticated with 'bearer'")
		}
		jwtTokString := splits[1]
		jwtTok, err := jose.ParseSigned(jwtTokString)
		if err != nil {
			return nil, grpc.Errorf(codes.Unauthenticated, "failed to parse token: %v", err)
		}
		jwtPayload, err := jwtTok.Verify(publicKey)
		if err != nil {
			return nil, grpc.Errorf(codes.Unauthenticated, "failed to verify token: %v", err)
		}
		newCtx = context.WithValue(ctx, TokenKey, jwtPayload)
		if err != nil {
			return nil, err
		}
		return handler(newCtx, req)
	}
}
CredStoreTokenInterceptor returns a new unary server interceptor that performs per-request auth.
package client
import (
	"crypto"
	"encoding/json"
	"strings"
	"github.com/google/credstore/jwt"
	"golang.org/x/net/context"
	"google.golang.org/grpc"
	"google.golang.org/grpc/codes"
	"google.golang.org/grpc/metadata"
	jose "gopkg.in/square/go-jose.v2"
)
type tokenKeyType struct{}
var TokenKey = tokenKeyType{}