async function tokenConsumer(bucketName, objectName) {
    // Create the OAuth credentials (the consumer).
    const oauth2Client = new OAuth2Client();
    // We are defining a refresh handler instead of a one-time access
    // token/expiry pair.
    // This will allow the consumer to obtain new downscoped tokens on
    // demand every time a token is expired, without any additional code
    // changes.
    oauth2Client.refreshHandler = async () => {
      // The common pattern of usage is to have a token broker pass the
      // downscoped short-lived access tokens to a token consumer via some
      // secure authenticated channel. For illustration purposes, we are
      // generating the downscoped token locally. We want to test the ability
      // to limit access to objects with a certain prefix string in the
      // resource bucket. objectName.substring(0, 3) is the prefix here. This
      // field is not required if access to all bucket resources are allowed.
      // If access to limited resources in the bucket is needed, this mechanism
      // can be used.
      const refreshedAccessToken = await getTokenFromBroker(
        bucketName,
        objectName.substring(0, 3)
      );
      return {
        access_token: refreshedAccessToken.token,
        expiry_date: refreshedAccessToken.expirationTime,
      };
    };

    const storageOptions = {
      projectId: process.env.GOOGLE_CLOUD_PROJECT,
      authClient: oauth2Client,
    };

    const storage = new Storage(storageOptions);
    const downloadFile = await storage
      .bucket(bucketName)
      .file(objectName)
      .download();
    console.log(downloadFile.toString('utf8'));
  }
Simulates token consumer generating calling GCS APIs using generated
downscoped tokens for specified bucket.

@param bucketName The name of the Cloud Storage bucket.
@param objectName The name of the object in the Cloud Storage bucket
       to read.