code: func (h *protocolHandler) handleGetOAuthToken(req *rpcs.GetOAuthTokenRequest) (*rpcs.GetOAuthTokenResponse, error) {
  	// Validate the request.
  	if err := req.Validate(); err != nil {
  		return nil, &protocolError{
  			Status:  400,
  			Message: fmt.Sprintf("Bad request: %s.", err.Error()),
  		}
  	}
  	if subtle.ConstantTimeCompare(h.secret, req.Secret) != 1 {
  		return nil, &protocolError{
  			Status:  403,
  			Message: "Invalid secret.",
  		}
  	}
  	generator := h.tokens[req.AccountID]
  	if generator == nil {
  		return nil, &protocolError{
  			Status:  404,
  			Message: fmt.Sprintf("Unrecognized account ID %q.", req.AccountID),
  		}
  	}
  
  	// Dedup and sort scopes.
  	scopes := stringset.New(len(req.Scopes))
  	for _, s := range req.Scopes {
  		scopes.Add(s)
  	}
  	sortedScopes := scopes.ToSlice()
  	sort.Strings(sortedScopes)
  
  	// Ask the token provider for the token. This may produce ErrorWithCode.
  	tok, err := generator.GenerateToken(h.ctx, sortedScopes, minTokenLifetime)
  	if err != nil {
  		return nil, err
  	}
  	return &rpcs.GetOAuthTokenResponse{
  		AccessToken: tok.AccessToken,
  		Expiry:      tok.Expiry.Unix(),
  	}, nil
  }
docs: ////////////////////////////////////////////////////////////////////////////////
  // RPC implementations.