Handle non-2xx for metadata server responses.
diff --git a/google/google.go b/google/google.go
index b98ce81..2fcf8a6 100644
--- a/google/google.go
+++ b/google/google.go
@@ -15,6 +15,7 @@
 
 import (
 	"encoding/json"
+	"fmt"
 	"io/ioutil"
 	"net/http"
 	"time"
@@ -114,6 +115,9 @@
 		return
 	}
 	defer resp.Body.Close()
+	if resp.StatusCode < 200 || resp.StatusCode > 299 {
+		return nil, fmt.Errorf("oauth2: can't retrieve a token from metadata server, status code: %d", resp.StatusCode)
+	}
 	var tokenResp metaTokenRespBody
 	err = json.NewDecoder(resp.Body).Decode(&tokenResp)
 	if err != nil {