code: func getClaimJWT(client *http.Client, url, accessToken string) (string, error) {
  	ctx, cancel := context.WithCancel(context.Background())
  	defer cancel()
  
  	// TODO: Allow passing request body with configurable information.
  	req, err := http.NewRequest("GET", url, nil)
  	if err != nil {
  		return "", fmt.Errorf("while calling %v: %v", url, err)
  	}
  	if accessToken != "" {
  		req.Header.Set("Authorization", fmt.Sprintf("Bearer %v", accessToken))
  	}
  	req = req.WithContext(ctx)
  	response, err := client.Do(req)
  	if err != nil {
  		return "", err
  	}
  	// Report non-OK status code as an error.
  	if response.StatusCode < http.StatusOK || response.StatusCode > http.StatusIMUsed {
  		return "", fmt.Errorf("error while getting distributed claim JWT: %v", response.Status)
  	}
  	defer response.Body.Close()
  	responseBytes, err := ioutil.ReadAll(response.Body)
  	if err != nil {
  		return "", fmt.Errorf("could not decode distributed claim response")
  	}
  	return string(responseBytes), nil
  }
docs: // getClaimJWT gets a distributed claim JWT from url, using the supplied access
  // token as bearer token.  If the access token is "", the authorization header
  // will not be set.
  // TODO: Allow passing in JSON hints to the IDP.