gserviceaccount/gserviceaccount.go
func (gsa *GServiceAccount) TokenSource(ctxt context.Context, scopes ...string) (*bearer.Bearer, error) {
	var err error

	// simple check that required fields are present
	if gsa.ClientEmail == "" || gsa.TokenURI == "" {
		return nil, errors.New("jwt/gserviceaccount: ClientEmail and TokenURI cannot be empty")
	}

	// set up subject and context
	if ctxt == nil {
		ctxt = context.Background()
	}

	// get signer
	signer, err := gsa.Signer()
	if err != nil {
		return nil, err
	}

	// determine expiration
	expiration := gsa.expiration
	if expiration == 0 {
		expiration = DefaultExpiration
	}

	// bearer grant options
	opts := []bearer.Option{
		bearer.ExpiresIn(expiration),
		bearer.IssuedAt(true),
		bearer.Claim("iss", gsa.ClientEmail),
		bearer.Claim("aud", gsa.TokenURI),
		bearer.Scope(scopes...),
	}

	// add transport
	if gsa.transport != nil {
		opts = append(opts, bearer.Transport(gsa.transport))
	}

	// create token source
	b, err := bearer.NewTokenSource(
		signer,
		gsa.TokenURI,
		ctxt,
		opts...,
	)
	if err != nil {
		return nil, err
	}

	return b, nil
}
func (gsa *GServiceAccount) TokenSource(ctxt context.Context, scopes ...string) (*bearer.Bearer, error) {
	var err error

	// simple check that required fields are present
	if gsa.ClientEmail == "" || gsa.TokenURI == "" {
		return nil, errors.New("jwt/gserviceaccount: ClientEmail and TokenURI cannot be empty")
	}

	// set up subject and context
	if ctxt == nil {
		ctxt = context.Background()
	}

	// get signer
	signer, err := gsa.Signer()
	if err != nil {
		return nil, err
	}

	// determine expiration
	expiration := gsa.expiration
	if expiration == 0 {
		expiration = DefaultExpiration
	}

	// bearer grant options
	opts := []bearer.Option{
		bearer.ExpiresIn(expiration),
		bearer.IssuedAt(true),
		bearer.Claim("iss", gsa.ClientEmail),
		bearer.Claim("aud", gsa.TokenURI),
		bearer.Scope(scopes...),
	}

	// add transport
	if gsa.transport != nil {
		opts = append(opts, bearer.Transport(gsa.transport))
	}

	// create token source
	b, err := bearer.NewTokenSource(
		signer,
		gsa.TokenURI,
		ctxt,
		opts...,
	)
	if err != nil {
		return nil, err
	}

	return b, nil
}
// TokenSource returns a oauth2.TokenSource for the Google Service Account
// using the provided context and scopes. The resulting token source should be
// wrapped with oauth2.ReusableTokenSource prior to being used elsewhere.
//
// If the supplied context is nil, context.Background() will be used.
//
// If additional claims need to be added to the TokenSource (ie, subject or the
// "sub" field), use jwt/bearer.Claim to add them before wrapping the
// TokenSource with oauth2.ReusableTokenSource.