code: func tokenEndpoint(client *http.Client, issuer string) (string, error) {
  	// Well known URL for getting OpenID Connect metadata.
  	//
  	// https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig
  	wellKnown := strings.TrimSuffix(issuer, "/") + "/.well-known/openid-configuration"
  	resp, err := client.Get(wellKnown)
  	if err != nil {
  		return "", err
  	}
  	defer resp.Body.Close()
  
  	body, err := ioutil.ReadAll(resp.Body)
  	if err != nil {
  		return "", err
  	}
  	if resp.StatusCode != http.StatusOK {
  		// Don't produce an error that's too huge (e.g. if we get HTML back for some reason).
  		const n = 80
  		if len(body) > n {
  			body = append(body[:n], []byte("...")...)
  		}
  		return "", fmt.Errorf("oidc: failed to query metadata endpoint %s: %q", resp.Status, body)
  	}
  
  	// Metadata object. We only care about the token_endpoint, the thing endpoint
  	// we'll be refreshing against.
  	//
  	// https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
  	var metadata struct {
  		TokenURL string `json:"token_endpoint"`
  	}
  	if err := json.Unmarshal(body, &metadata); err != nil {
  		return "", fmt.Errorf("oidc: failed to decode provider discovery object: %v", err)
  	}
  	if metadata.TokenURL == "" {
  		return "", fmt.Errorf("oidc: discovery object doesn't contain a token_endpoint")
  	}
  	return metadata.TokenURL, nil
  }
docs: // tokenEndpoint uses OpenID Connect discovery to determine the OAuth2 token
  // endpoint for the provider, the endpoint the client will use the refresh
  // token against.