code: func (a *Authenticator) GetAccessToken(lifetime time.Duration) (*oauth2.Token, error) {
  	tok, err := a.currentToken()
  	if err != nil {
  		return nil, err
  	}
  	// Impose some arbitrary limit, since <= 0 lifetime won't work.
  	if lifetime < time.Second {
  		lifetime = time.Second
  	}
  	if tok == nil || internal.TokenExpiresInRnd(a.ctx, tok, lifetime) {
  		// Give 5 sec extra to make sure callers definitely receive a token that
  		// has at least 'lifetime' seconds of life left. Without this margin, we
  		// can get into an unlucky situation where the token is valid here, but
  		// no longer valid (has fewer than 'lifetime' life left) up the stack, due
  		// to the passage of time.
  		var err error
  		tok, err = a.refreshToken(tok, lifetime+5*time.Second)
  		if err != nil {
  			return nil, err
  		}
  		// Note: no randomization here. It is a sanity check that verifies
  		// refreshToken did its job.
  		if internal.TokenExpiresIn(a.ctx, tok, lifetime) {
  			return nil, fmt.Errorf("auth: failed to refresh the token")
  		}
  	}
  	return &tok.Token, nil
  }
docs: // GetAccessToken returns a valid access token with specified minimum lifetime.
  //
  // Does not interact with the user. May return ErrLoginRequired.