Source: auth.go in package golang.org/x/pkgsite/internal/auth

Package auth authorizes programs to make HTTP requests to the discovery site.

package auth

import (
	"context"
	"fmt"
	"net/http"

	"golang.org/x/pkgsite/internal/derrors"
	"google.golang.org/api/idtoken"
)

OAuth 2.0 Client IDs for the go-discovery (main) and the go-discovery-exp (exp) projects. See https://cloud.google.com/iap/docs/authentication-howto for more details.

const (
	mainClientID = "117187402928-nl3u0qo5l2c2hhsuf2qj8irsfb3l6hfc.apps.googleusercontent.com"
	expClientID  = "55665122702-tk2rogkaalgru7pqibvbltqs7geev8j5.apps.googleusercontent.com"
)

NewClient creates an http.Client for accessing go-discovery services. Its first argument is the JSON contents of a service account credentials file. If nil, default credentials are used. Its second argument determines which client ID to use.

func NewClient(ctx context.Context, jsonCreds []byte, useExp bool) (_ *http.Client, err error) {
	defer derrors.Wrap(&err, "auth.NewClient(jsonCreds, %t)", useExp)
	audience, opts := idtokenArgs(jsonCreds, useExp)
	return idtoken.NewClient(ctx, audience, opts...)
}

Header returns a header value (typically a Bearer token) to be used in the HTTP 'Authorization' header.

func Header(ctx context.Context, jsonCreds []byte, useExp bool) (_ string, err error) {
	defer derrors.Wrap(&err, "auth.Header(jsonCreds, %t)", useExp)

	audience, opts := idtokenArgs(jsonCreds, useExp)
	ts, err := idtoken.NewTokenSource(ctx, audience, opts...)
	if err != nil {
		return "", err
	}
	token, err := ts.Token()
	if err != nil {
		return "", fmt.Errorf("TokenSource.Token(): %v", err)

This is a dummy request to get the authorization header.

	req, err := http.NewRequest("GET", "http://localhost", nil)
	if err != nil {
		return "", fmt.Errorf("http.NewRequest(): %v", err)
	}
	token.SetAuthHeader(req)
	return req.Header.Get("Authorization"), nil
}

func idtokenArgs(jsonCreds []byte, useExp bool) (string, []idtoken.ClientOption) {
	var opts []idtoken.ClientOption
	if len(jsonCreds) > 0 {
		opts = append(opts, idtoken.WithCredentialsJSON(jsonCreds))
	}
	audience := mainClientID
	if useExp {
		audience = expClientID
	}
	return audience, opts