code: func authenticationURI(c context.Context, cfg *Settings, state map[string]string) (string, error) {
  	if cfg.ClientID == "" || cfg.RedirectURI == "" {
  		return "", ErrNotConfigured
  	}
  
  	// Grab authorization URL from discovery doc.
  	discovery, err := fetchDiscoveryDoc(c, cfg.DiscoveryURL)
  	if err != nil {
  		return "", err
  	}
  	if discovery.AuthorizationEndpoint == "" {
  		return "", errors.New("openid: bad discovery doc, empty authorization_endpoint")
  	}
  
  	// Wrap state into HMAC-protected token.
  	stateTok, err := openIDStateToken.Generate(c, nil, state, 0)
  	if err != nil {
  		return "", err
  	}
  
  	// Generate final URL.
  	v := url.Values{}
  	v.Set("client_id", cfg.ClientID)
  	v.Set("redirect_uri", cfg.RedirectURI)
  	v.Set("response_type", "code")
  	v.Set("scope", "openid email profile")
  	v.Set("prompt", "select_account")
  	v.Set("state", stateTok)
  	return discovery.AuthorizationEndpoint + "?" + v.Encode(), nil
  }
docs: // authenticationURI returns an URI to redirect a user to in order to
  // authenticate via OpenID.
  //
  // This is step 1 of the authentication flow. Generate authentication URL and
  // redirect user's browser to it. After consent screen, redirect_uri will be
  // called (via user's browser) with `state` and authorization code passed to it,
  // eventually resulting in a call to 'handle_authorization_code'.