func (s *TokenSource) newClaims() (string, error) {
	c := claims{
		Scope: strings.Join(s.scopes, " "),
		Aud:   audienceURL,
		Iss:   s.actAsAccount,
		Iat:   time.Now().Unix(),
	}
	j, err := json.Marshal(c)
	if err != nil {
		return "", err
	}
	claimsEncoded := strings.Replace(string(j), "\"", "\\\"", -1)
	claimsPayload := "{\"payload\": \"" + claimsEncoded + "\"}"
	return claimsPayload, nil
}
newClaims constructs and encode the jwt claims.
package actas
import (
	"context"
	"encoding/json"
	"fmt"
	"io/ioutil"
	"net/http"
	"net/url"
	"strings"
	"time"
	log "github.com/golang/glog"
	"golang.org/x/oauth2"
	"google.golang.org/grpc/credentials"
)
const (
	signJWTURLTemplate = "https://iam.googleapis.com/v1/projects/-/serviceAccounts/%s:signJwt"
	audience           = "https://www.googleapis.com/oauth2/v4/token"
	grantType          = "urn:ietf:params:oauth:grant-type:jwt-bearer"
	expiryWiggleRoom = 120 * time.Second
)
var newSignJWTURL = func(account string) string {
	return fmt.Sprintf(signJWTURLTemplate, account)
}
var audienceURL = audience
type TokenSource struct {
	ctx context.Context
	actAsAccount string
	cred credentials.PerRPCCredentials
	scopes []string
	httpClient *http.Client
}
func NewTokenSource(ctx context.Context, cred credentials.PerRPCCredentials, client *http.Client, actAsAccount string, scopes []string) *TokenSource {
	return &TokenSource{
		ctx:          ctx,
		actAsAccount: actAsAccount,
		cred:         cred,
		scopes:       scopes,
		httpClient:   client,
	}
}
func (s *TokenSource) Token() (*oauth2.Token, error) {
	log.Infof("Generating new act-as token.")
	authHeaders, err := s.cred.GetRequestMetadata(s.ctx)
	if err != nil {
		return nil, err
	}
	log.V(1).Infof("Obtained credentials request metadata: %+v", authHeaders)
	signature, err := s.getSignedJWT(authHeaders)
	if err != nil {
		return nil, err
	}
	token, err := s.getToken(authHeaders, signature)
	if err != nil {
		return nil, err
	}
	return token, nil
}
type claims struct {
	Scope string `json:"scope"`
	Iss   string `json:"iss"`
	Aud   string `json:"aud"`
	Iat   int64  `json:"iat"`
}