code: public static SignedJWT generateJWToken(User user, App app) {
  		if (app != null) {
  			try {
  				Date now = new Date();
  				JWTClaimsSet.Builder claimsSet = new JWTClaimsSet.Builder();
  				String userSecret = "";
  				claimsSet.issueTime(now);
  				claimsSet.expirationTime(new Date(now.getTime() + (app.getTokenValiditySec() * 1000)));
  				claimsSet.notBeforeTime(now);
  				claimsSet.claim("refresh", getNextRefresh(app.getTokenValiditySec()));
  				claimsSet.claim(Config._APPID, app.getId());
  				if (user != null) {
  					claimsSet.subject(user.getId());
  					userSecret = user.getTokenSecret();
  				}
  				JWSSigner signer = new MACSigner(app.getSecret() + userSecret);
  				SignedJWT signedJWT = new SignedJWT(new JWSHeader(JWSAlgorithm.HS256), claimsSet.build());
  				signedJWT.sign(signer);
  				return signedJWT;
  			} catch (JOSEException e) {
  				logger.warn("Unable to sign JWT: {}.", e.getMessage());
  			}
  		}
  		return null;
  	}
docs: Generates a new JWT token.
  @param user a User object belonging to the app
  @param app the app object
  @return a new JWT or null