code: func asProjectHeaders(c context.Context, uri string, opts *rpcOptions) (*oauth2.Token, map[string]string, error) {
  	internal, err := isInternalURI(c, uri)
  	if err != nil {
  		return nil, nil, err
  	}
  
  	// For calls within a single LUCI deployment use the service's own OAuth2
  	// token and 'X-Luci-Project' header to convey the project identity to the
  	// peer.
  	if internal {
  		tok, _, err := asSelfHeaders(c, uri, opts)
  		return tok, map[string]string{XLUCIProjectHeader: opts.project}, err
  	}
  
  	// For calls to external (non-LUCI) services get an OAuth2 token of a project
  	// scoped service account.
  	mintTokenCall := MintProjectToken
  	if opts.rpcMocks != nil && opts.rpcMocks.MintProjectToken != nil {
  		mintTokenCall = opts.rpcMocks.MintProjectToken
  	}
  	mintParams := ProjectTokenParams{
  		MinTTL:      2 * time.Minute,
  		LuciProject: opts.project,
  		OAuthScopes: opts.scopes,
  	}
  
  	tok, err := mintTokenCall(c, mintParams)
  	// TODO(fmatenaar): This is only during migration and needs to be removed eventually.
  	if tok == nil && err == nil {
  		logging.Infof(c, "project %s not found, fallback to service identity", opts.project)
  		return asSelfHeaders(c, uri, opts)
  	}
  	return tok, nil, err
  }
docs: // asProjectHeaders returns a map of authentication headers to add to outbound
  // RPC requests done in AsProject mode.
  //
  // This will be called by the transport layer on each request.