One way I think of it is simple:
Service A provides an API: /check_token, Service B adds an Interceptor to intercept all requests, and then calls Service A's API to verify and obtain permissions