def get_auth_token(api, service_account=None):
  """
  Get an auth token; this assumes the user is logged in with the infra
  authutil command line utility.

  If service_account is provided, that service account will be used when calling
  authutil.
  """
  cmd = ['/opt/infra-tools/authutil', 'token']
  if service_account: # pragma: no cover
      cmd.extend([
          '-service-account-json='
          '/creds/service_accounts/service-account-%s.json' % service_account])

  result = api.step(
      'Get auth token', cmd,
      stdout=api.raw_io.output(),
      step_test_data=lambda: api.raw_io.test_api.stream_output('ya29.foobar'))
  return result.stdout.strip()