code: func (m *OAuth2Method) Authenticate(c context.Context, r *http.Request) (*auth.User, error) {
  	if info.IsDevAppServer(c) {
  		// On "dev_appserver", we verify OAuth2 tokens using Google's OAuth2
  		// verification endpoint.
  		//
  		// It is slow as hell on "dev_appserver", but good enough for local manual
  		// testing.
  		devMethod := auth.GoogleOAuth2Method{
  			Scopes: m.Scopes,
  		}
  		return devMethod.Authenticate(c, r)
  	}
  
  	header := r.Header.Get("Authorization")
  	if header == "" || len(m.Scopes) == 0 {
  		return nil, nil // this method is not applicable
  	}
  
  	// GetOAuthUser RPC is notoriously flaky. Do a bunch of retries on errors.
  	var err error
  	for attemp := 0; attemp < 4; attemp++ {
  		var u *user.User
  		u, err = user.CurrentOAuth(c, m.Scopes...)
  		if err != nil {
  			logging.Warningf(c, "oauth: failed to execute GetOAuthUser - %s", err)
  			continue
  		}
  		if u == nil {
  			return nil, nil
  		}
  		if u.ClientID == "" {
  			return nil, fmt.Errorf("oauth: ClientID is unexpectedly empty")
  		}
  		id, idErr := identity.MakeIdentity("user:" + u.Email)
  		if idErr != nil {
  			return nil, idErr
  		}
  		return &auth.User{
  			Identity:  id,
  			Superuser: u.Admin,
  			Email:     u.Email,
  			ClientID:  u.ClientID,
  		}, nil
  	}
  	return nil, transient.Tag.Apply(err)
  }
docs: // Authenticate extracts peer's identity from the incoming request.