@@ -24,7 +24,12 @@
     from google.api_core.client_options import ClientOptions
     from google.cloud.vision_v1 import ImageAnnotatorClient
 
-    options = ClientOptions(api_endpoint="foo.googleapis.com")
+    def get_client_cert():
+        # code to load client certificate and private key.
+        return client_cert_bytes, client_private_key_bytes
+
+    options = ClientOptions(api_endpoint="foo.googleapis.com",
+        client_cert_source=get_client_cert)
 
     client = ImageAnnotatorClient(client_options=options)
 
@@ -34,7 +39,11 @@
 
     from google.cloud.vision_v1 import ImageAnnotatorClient
 
-    client = ImageAnnotatorClient(client_options={"api_endpoint": "foo.googleapis.com"})
+    client = ImageAnnotatorClient(
+        client_options={
+            "api_endpoint": "foo.googleapis.com",
+            "client_cert_source" : get_client_cert
+        })
 
 
 """
@@ -45,10 +54,14 @@ class ClientOptions(object):
 
     Args:
         api_endpoint (str): The desired API endpoint, e.g., compute.googleapis.com
+        client_cert_source (Callable[[], (bytes, bytes)]): An optional callback
+            which returns client certificate bytes and private key bytes both in
+            PEM format.
     """
 
-    def __init__(self, api_endpoint=None):
+    def __init__(self, api_endpoint=None, client_cert_source=None):
         self.api_endpoint = api_endpoint
+        self.client_cert_source = client_cert_source
 
     def __repr__(self):
         return "ClientOptions: " + repr(self.__dict__)
 
@@ -112,7 +112,7 @@ def docs(session):
 
     session.install(".", "grpcio >= 1.8.2", "grpcio-gcp >= 0.2.2")
     session.install("-e", ".")
-    session.install("sphinx", "alabaster", "recommonmark")
+    session.install("sphinx < 3.0", "alabaster", "recommonmark")
 
     shutil.rmtree(os.path.join("docs", "_build"), ignore_errors=True)
     session.run(
 
@@ -31,7 +31,7 @@
 dependencies = [
     "googleapis-common-protos >= 1.6.0, < 2.0dev",
     "protobuf >= 3.4.0",
-    "google-auth >= 0.4.0, < 2.0dev",
+    "google-auth >= 1.14.0, < 2.0dev",
     "requests >= 2.18.0, < 3.0.0dev",
     "setuptools >= 34.0.0",
     "six >= 1.10.0",
 
@@ -17,26 +17,46 @@
 from google.api_core import client_options
 
 
+def get_client_cert():
+    return b"cert", b"key"
+
+
 def test_constructor():
-    options = client_options.ClientOptions(api_endpoint="foo.googleapis.com")
+
+    options = client_options.ClientOptions(
+        api_endpoint="foo.googleapis.com", client_cert_source=get_client_cert
+    )
 
     assert options.api_endpoint == "foo.googleapis.com"
+    assert options.client_cert_source() == (b"cert", b"key")
 
 
 def test_from_dict():
-    options = client_options.from_dict({"api_endpoint": "foo.googleapis.com"})
+    options = client_options.from_dict(
+        {"api_endpoint": "foo.googleapis.com", "client_cert_source": get_client_cert}
+    )
 
     assert options.api_endpoint == "foo.googleapis.com"
+    # assert options.client_cert_source == get_client_cert
+    assert options.client_cert_source() == (b"cert", b"key")
 
 
 def test_from_dict_bad_argument():
     with pytest.raises(ValueError):
         client_options.from_dict(
-            {"api_endpoint": "foo.googleapis.com", "bad_arg": "1234"}
+            {
+                "api_endpoint": "foo.googleapis.com",
+                "bad_arg": "1234",
+                "client_cert_source": get_client_cert,
+            }
         )
 
 
 def test_repr():
     options = client_options.ClientOptions(api_endpoint="foo.googleapis.com")
 
-    assert repr(options) == "ClientOptions: {'api_endpoint': 'foo.googleapis.com'}"
+    assert (
+        repr(options)
+        == "ClientOptions: {'api_endpoint': 'foo.googleapis.com', 'client_cert_source': None}"
+        or "ClientOptions: {'client_cert_source': None, 'api_endpoint': 'foo.googleapis.com'}"
+    )