Best practices for Auth on the backend

I'm wondering how to implement authentication in a Cloud Endpoints backend on the principle that I don't want to make the implementation specific to Endpoints.

I'm using gRPC and Cloud Run.

My current, naive implementation uses a gRPC interceptor and this **expects** `x-endpoint-api-userinfo` in the call's metadata (obtained from the context).

I've configured Firebase Authentication and Google Identity Tokens. The latter to short-circuit my workflow and provide me an easier way to authenticate requests through Endpoints.

However, I'm thinking that it would be better for the Interceptor to look for Cloud Endpoints specific metadata (?) to authenticate and, if not found, fall back to authenticating using the `Authorization` header (assuming this means the service is running on e.g. Cloud Run without Endpoints, for testing) and, if that's not found, permit **without** authentication (assuming the service is running locally).

Under this configuration, I must always ensure I deploy the backend to Cloud Run with `--no-allow-unauthenticated` but that should always be the case and it means the service is loosely-coupled to Endpoints.

Is this approach reasonable? What (other) flaws am I overlooking?

Is there a set of documented best practices for Cloud Endpoints?