code: func (cl *Client) GenerateAccessToken(c context.Context, serviceAccount string, scopes []string, delegates []string, lifetime time.Duration) (*oauth2.Token, error) {
  	var body struct {
  		Delegates []string `json:"delegates"`
  		Scope     []string `json:"scope"`
  		Lifetime  string   `json:"lifetime,omitempty"`
  	}
  
  	body.Scope = scopes
  	body.Delegates = delegates
  
  	// Default lifetime is 3600 seconds according to API documentation.
  	// Requesting longer lifetime will cause an API error which is
  	// forwarded to the caller.
  	if lifetime > 0 {
  		body.Lifetime = lifetime.String()
  	}
  
  	var resp struct {
  		AccessToken string `json:"accessToken"`
  		ExpireTime  string `json:"expireTime"`
  	}
  	if err := cl.credentialsAPIRequest(c, fmt.Sprintf("projects/-/serviceAccounts/%s", url.QueryEscape(serviceAccount)), "generateAccessToken", &body, &resp); err != nil {
  		return nil, err
  	}
  
  	expires, err := time.Parse(time.RFC3339, resp.ExpireTime)
  	if err != nil {
  		err = fmt.Errorf("Unable to parse 'expireTime': %s", resp.ExpireTime)
  		logging.WithError(err).Errorf(c, "Bad token endpoint response, unable to parse expireTime")
  		return nil, err
  	}
  
  	return &oauth2.Token{
  		AccessToken: resp.AccessToken,
  		TokenType:   tokenType,
  		Expiry:      expires.UTC(),
  	}, nil
  
  }
docs: // GenerateAccessToken creates a service account OAuth token using IAM's
  // :generateAccessToken API.
  //
  // On non-success HTTP status codes returns googleapi.Error.