code: func NewUserAuthTokenProvider(ctx context.Context, clientID, clientSecret string, scopes []string) (TokenProvider, error) {
  	return &userAuthTokenProvider{
  		config: &oauth2.Config{
  			ClientID:     clientID,
  			ClientSecret: clientSecret,
  			Endpoint: oauth2.Endpoint{
  				AuthURL:  "https://accounts.google.com/o/oauth2/auth",
  				TokenURL: "https://accounts.google.com/o/oauth2/token",
  			},
  			RedirectURL: "urn:ietf:wg:oauth:2.0:oob",
  			Scopes:      scopes,
  		},
  		cacheKey: CacheKey{
  			Key:    fmt.Sprintf("user/%s", clientID),
  			Scopes: scopes,
  		},
  	}, nil
  }
docs: // NewUserAuthTokenProvider returns TokenProvider that can perform 3-legged
  // OAuth flow involving interaction with a user.