I feel like HTTP is too heavyweight for microservices. For monoliths, it's great. And the only way to proceed in your case is to convert microservices into mini-monoliths. Particularly the authentication side, which needs to be revalidated with every request.
gRPC might be better, but supposedly so was SOAP, CORBA, DCOM, XMLRPC, and finally REST.