docs: function ( details, cipherEncrypt, sign, numBytes) {
  
    var cmk = new Buffer( b64url.b64( details.credentials.key ), 'base64' )
    if (numBytes != cmk.length)
      throw new Error("key is not "+numBytes+" long.")
  
    var kdf = concatKDF(cmk)
  
    var plainText = JSON.stringify( details.payload)
    var iv = crypto.randomBytes( 16)
  
    // encrypt
    var cipher = crypto.createCipheriv( cipherEncrypt, kdf.cek, iv)
    var cipherText = b64url.safe( cipher.update( plainText, 'utf8', 'base64' ) )
    cipherText += b64url.safe( cipher.final( 'base64')  )
  
    // create signature
    var input = b64url.encode( JSON.stringify( details.header)) +'..'+ b64url.encode(iv) +'.'+ cipherText
    var hmac = crypto.createHmac( sign, kdf.cik).update(input);
    var token = input +'.'+ b64url.safe( hmac.digest('base64'))
    return token;
  }