code: func (gsa *GServiceAccount) TokenSource(ctxt context.Context, scopes ...string) (*bearer.Bearer, error) {
  	var err error
  
  	// simple check that required fields are present
  	if gsa.ClientEmail == "" || gsa.TokenURI == "" {
  		return nil, errors.New("jwt/gserviceaccount: ClientEmail and TokenURI cannot be empty")
  	}
  
  	// set up subject and context
  	if ctxt == nil {
  		ctxt = context.Background()
  	}
  
  	// get signer
  	signer, err := gsa.Signer()
  	if err != nil {
  		return nil, err
  	}
  
  	// determine expiration
  	expiration := gsa.expiration
  	if expiration == 0 {
  		expiration = DefaultExpiration
  	}
  
  	// bearer grant options
  	opts := []bearer.Option{
  		bearer.ExpiresIn(expiration),
  		bearer.IssuedAt(true),
  		bearer.Claim("iss", gsa.ClientEmail),
  		bearer.Claim("aud", gsa.TokenURI),
  		bearer.Scope(scopes...),
  	}
  
  	// add transport
  	if gsa.transport != nil {
  		opts = append(opts, bearer.Transport(gsa.transport))
  	}
  
  	// create token source
  	b, err := bearer.NewTokenSource(
  		signer,
  		gsa.TokenURI,
  		ctxt,
  		opts...,
  	)
  	if err != nil {
  		return nil, err
  	}
  
  	return b, nil
  }
docs: // TokenSource returns a oauth2.TokenSource for the Google Service Account
  // using the provided context and scopes. The resulting token source should be
  // wrapped with oauth2.ReusableTokenSource prior to being used elsewhere.
  //
  // If the supplied context is nil, context.Background() will be used.
  //
  // If additional claims need to be added to the TokenSource (ie, subject or the
  // "sub" field), use jwt/bearer.Claim to add them before wrapping the
  // TokenSource with oauth2.ReusableTokenSource.