code: func GetTokenSource(c context.Context, kind RPCAuthorityKind, opts ...RPCOption) (oauth2.TokenSource, error) {
  	if kind != AsSelf && kind != AsCredentialsForwarder && kind != AsActor {
  		return nil, fmt.Errorf("auth: GetTokenSource can only be used with AsSelf, AsCredentialsForwarder or AsActor authorization kind")
  	}
  	options, err := makeRPCOptions(kind, opts)
  	if err != nil {
  		return nil, err
  	}
  	if options.checkCtx != nil {
  		if err := options.checkCtx(c); err != nil {
  			return nil, err
  		}
  	}
  	return &tokenSource{c, options}, nil
  }
docs: // GetTokenSource returns an oauth2.TokenSource bound to the supplied Context.
  //
  // Supports only AsSelf, AsCredentialsForwarder and AsActor authorization kinds,
  // since they are only ones that exclusively use OAuth2 tokens and no other
  // extra headers.
  //
  // While GetPerRPCCredentials is preferred, this can be used by packages that
  // cannot or do not properly handle this gRPC option.