Token-based authentication to Couchbase Server APIs

We need to provide a token based authentication mechanism for API access to Couchbase Server.  This is useful for scripts and eventing functions accessing the cluster, so that they aren't provided with plaintext credentials.  It is also useful for SSO users to access the cluster from a command line. 

The token ideally would be an existing standard, and be based on OAuth 2.0 or a JWT