In OAuth 1.0, 2-legged is pretty easily: Simply send the request as usual and omit the access_token header.
access_token
Things seems to have changed in OAuth 2.0 (d
You can also check out Google's implementation of 2-legged OAuth2 (I believe this documentation has been published only recently).
The Google Drive SDK delegation docs should also help understanding Google's 2-legged OAuth2 implementation.