// Google documentation: https://developers.google.com/identity/protocols/OAuth2ServiceAccount#creatingjwt
public class GoogleAuthentication {
    private final static String PRIVATE_KEY = "privatekey"; // replace with what you named your jks token
    private final static String AUTH_ENDPOINT = "https://www.googleapis.com/oauth2/v4/token";
    private final static String JWS_SCOPE = "scope";
    private final static String JWS_IAT = "iat";
    private final static String JWS_EXP = "exp";
    public final static String WRITE_SCOPE = "https://www.googleapis.com/auth/cloud-platform";

    // Store the access token in custom settings to reuse accross transactions
    private static GoogleStorage__c googleStorageSettings = GoogleStorage__c.getOrgDefaults();

    /**
     * Scope is defined as : A space-delimited list of the permissions that the application requests.
     * Can be https://www.googleapis.com/auth/cloud-platform for example to edit and manage. Return an
     * AuthenticationResponse to inform code if we have commit to DB to not make another callout in
     * the same transaction.
     */
    public static AuthenticationResponse getAccessToken(String scope) {
        AuthenticationResponse response = new AuthenticationResponse(googleStorageSettings.AccessToken__c);
        if (response.accessToken == null) {
        	response = fetchNewAccessToken(scope);
        }
        return response;
    }

    /**
     * JSON Web Token (JWT) bundles private key and some additional required information 
     */
    public static AuthenticationResponse fetchNewAccessToken(String scope) {
        Auth.JWT jwt = new Auth.JWT();
        String serviceAccountEmail = googleStorageSettings.ServiceAccountEmail__c;
        Map<String, Object> claimMap = buildClaimMap(scope);

        jwt.setIss(serviceAccountEmail);
        jwt.setAud(AUTH_ENDPOINT);
        jwt.setAdditionalClaims(claimMap);

        // 'privatekey' cert created using java keytool converting p12 file obtained from google to jks
        Auth.JWS jws = new Auth.JWS(jwt, PRIVATE_KEY);

        // may throw a Auth.JWTBearerTokenExchange.​JWTBearerTokenExchangeException​
        Auth.JWTBearerTokenExchange bearer = new Auth.JWTBearerTokenExchange(AUTH_ENDPOINT, jws);
        AuthenticationResponse response = new AuthenticationResponse(bearer.getAccessToken());

        if (response.accessToken != null) {
        	googleStorageSettings.AccessToken__c = response.accessToken;
        	update googleStorageSettings;
        	response.requiresAjaxCall = true;
        }

        return response;
    }

    private static Map<String, Object> buildClaimMap(String scope) {
        Map<String, Object> claimMap = new Map<String, Object>();
        String issueTime = getIssueTime();
        String expirationTime = getExpirationTime(issueTime);

        claimMap.put(JWS_SCOPE, scope);
        claimMap.put(JWS_IAT,   issueTime);
        claimMap.put(JWS_EXP,   expirationTime);

        return claimMap;
    }

    private static String getIssueTime() {
        Long timeSince = System.now().getTime();
        String iatTime = String.valueOf(timeSince);
        return iatTime;
    }

    private static String getExpirationTime(String issueTime) {
        Long longIssueTime = Long.valueOf(issueTime);
        String expTime = String.valueOf(longIssueTime - 3600);
        return expTime;
    }

    public class AuthenticationResponse {
        public String accessToken;
        public Boolean requiresAjaxCall; // Must use javascript to start another transaction

        public AuthenticationResponse(String accessToken) {
            this.accessToken = accessToken;
            this.requiresAjaxCall = false;
        }
    }
}

public virtual class HttpCallout {
 
    protected Http callout { get; set;}
    protected HttpRequest request { get; set; }
    
    public HttpResponse response { get; set; }

    public HttpCallout(String method, String endpoint) {
        this.callout = new Http();
        this.request = new HttpRequest();
        this.request.setEndpoint(endpoint);
        this.request.setMethod(method);
    }

    public void send() {
        this.response = this.callout.send(this.request);
    }
}

public class GoogleStorageCallout extends HttpCallout {
	private String fileName;
	private String contentType;
	private Integer fileSize;
	private String fileBody;
	private String accessToken;
	public Boolean requiresAjaxCall;

	public static GoogleStorage__c googleStorageSettings = GoogleStorage__c.getInstance();
	private static final String MEDIA = "media";
	private static final String RESUMABLE = "resumable";
	private static final String AUTHOIZATION = "Authorization";
	private static final String BEARER = "Bearer ";
	private static final String CONTENT_TYPE = "Content-Type";
	private static final String CONTENT_LENGTH = "Content-Length";
	private static final String RANGE = "Content-Range";
	private static final String PREDEFINED_CONTENT_TYPE = "application/json; charset=UTF-8";

	private GoogleStorageCallout(String fileName, String contentType, String fileBody,
                                    Integer fileSize) {
		super(Util.HTTP_POST, buildEndpoint(fileName));
		this.fileName = fileName;
		this.contentType = contentType;
		this.fileBody = fileBody;
		this.fileSize = fileSize;
		setAccessToken();
		setRequestBody();
		setHeaders();
	}

	private void setAccessToken() {
		GoogleAuthentication.AuthenticationResponse response =
                    GoogleAuthentication.getAccessToken(GoogleAuthentication.WRITE_SCOPE);
		this.accessToken = response.accessToken;
		this.requiresAjaxCall = response.requiresAjaxCall;
	}

	public void refreshAccessToken() {
		GoogleAuthentication.AuthenticationResponse response =
                    GoogleAuthentication.fetchNewAccessToken(GoogleAuthentication.WRITE_SCOPE);
		this.accessToken = response.accessToken;
		this.requiresAjaxCall = response.requiresAjaxCall;
	}

	private void setRequestBody() {
		this.request.setBodyAsBlob(EncodingUtil.base64Decode(this.fileBody));
	}

	private void setHeaders() {
		this.request.setHeader(AUTHOIZATION, BEARER + this.accessToken);
                this.request.setHeader(CONTENT_TYPE, this.contentType);
                this.request.setHeader(CONTENT_LENGTH, String.valueOf(this.fileSize));
	}

	public void setAuthorizationHeader(String accessToken) {
		this.request.setHeader(AUTHOIZATION, BEARER + accessToken);
	}

	private static Integer calculateFileSize(Integer startByte, Integer endByte) {
		return endByte - startByte;
	}

	private static String buildEndpoint(String fileName) {
		return endpoint = googleStorageSettings.URL__c + googleStorageSettings.BucketName__c
                    + "/o?uploadType=" + MEDIA + "&name=" + fileName;
	}

	private static String buildRange(Integer startByte, Integer endByte) {
		return "bytes=" + String.valueOf(startByte) + "-" + String.valueOf(endByte);
	}
}

GoogleStorageCallout postImageCallout = new GoogleStorageCallout(
    your_image_name, your_image_content_type,
    your_image_body, your_image_file_size
);

if (postImageCallout.requiresAjaxCall) {
    // Access token was renewed, and you have to start another
    // transaction before making a callout due to Salesforce
    // restriction on Database commits.
} else {
    postImageCallout.send();
    if (postImageCallout.response.getStatusCode() >= 200
        && postImageCallout.response.getStatusCode() < 300) {
        // Success!
    } else if (postImageCallout.response.getStatusCode() >= 400
                && postImageCallout.response.getStatusCode() < 500) {
        // Access token has expired and you have to renew it!
        postImageCallout.refreshAccessToken();
    } else {
        // unexpected error
    }
}