All communication to and from the API endpoints take place using an encrypted communication channel (TLS). gRPC handles configuration of the TLS channel using channel credentials, and you should refer to their documentation.
The code snippets below show how to configure channel credentials using the default set of root certificates installed on your system, which is usually sufficient.
$channel_creds = Grpc\ChannelCredentials::createSsl();
# Allow the gRPC runtime to load root certificates from the default location.
# This is sufficient for most cases.
channel_creds = grpc.ssl_channel_credentials()
.trustManager(null) // load root certificates from the default location