Thank you for your response and suggestions.
Looks like exactly what I need:
- write custom plugin (preferably in go?) doing REST token validation
- define identity extractor via custom middleware in config
- bundle using tyk-cli bundler
- place in bundles directory
Sounds simple enough, however I can’t find any docs of any sample plugins / skeleton in Go?
I am as well very surprised there is no such plugin already 
Feels like a very common use case