code: func (s *Server) handleTokenRequest(rw http.ResponseWriter, r *http.Request, secret string) error {
  	ctx := r.Context()
  
  	// We support only refreshing access token via 'refresh_token' grant.
  	if r.PostFormValue("grant_type") != "refresh_token" {
  		return fmt.Errorf("expecting 'refresh_token' grant type")
  	}
  
  	// The token must match whatever we passed to gsutil via .boto. Unfortunately,
  	// gcloud's gsutil wrapper overrides the refresh token in the config unless
  	// 'pass_credentials_to_gsutil' is set to false via
  	//
  	// $ gcloud config set pass_credentials_to_gsutil false
  	//
  	// So hint the user to set it.
  	passedToken := r.PostFormValue("refresh_token")
  	if subtle.ConstantTimeCompare([]byte(passedToken), []byte(secret)) != 1 {
  		return fmt.Errorf("wrong refresh_token (if running via gcloud, set pass_credentials_to_gsutil = false)")
  	}
  
  	// Good enough. Grab an access token through the source and return it.
  	tok, err := s.Source.Token()
  	if err != nil {
  		return err
  	}
  	rw.Header().Set("Content-Type", "application/json")
  	return json.NewEncoder(rw).Encode(map[string]interface{}{
  		"access_token": tok.AccessToken,
  		"expires_in":   clock.Until(ctx, tok.Expiry) / time.Second,
  		"token_type":   "Bearer",
  	})
  }
docs: // handleTokenRequest handles /token call.
  //
  // The body of the request is documented here (among many other places):
  //   https://developers.google.com/identity/protocols/OAuth2InstalledApp#offline
  //
  // We ignore client_id and client_secret, since we aren't really running OAuth2.