code: func (r *MintOAuthTokenGrantRPC) mint(c context.Context, p *mintParams) (*minter.MintOAuthTokenGrantResponse, *tokenserver.OAuthTokenGrantBody, error) {
  	id, err := revocation.GenerateTokenID(c, tokenIDSequenceKind)
  	if err != nil {
  		logging.WithError(err).Errorf(c, "Error when generating token ID")
  		return nil, nil, status.Errorf(codes.Internal, "error when generating token ID - %s", err)
  	}
  
  	now := clock.Now(c).UTC()
  	expiry := now.Add(time.Duration(p.validityDuration) * time.Second)
  
  	// All the stuff here has already been validated in 'MintOAuthTokenGrant'.
  	body := &tokenserver.OAuthTokenGrantBody{
  		TokenId:          id,
  		ServiceAccount:   p.serviceAccount,
  		Proxy:            string(p.proxyID),
  		EndUser:          string(p.endUserID),
  		IssuedAt:         google.NewTimestamp(now),
  		ValidityDuration: p.validityDuration,
  	}
  	signed, err := SignGrant(c, r.Signer, body)
  	if err != nil {
  		logging.WithError(err).Errorf(c, "Error when signing the token")
  		return nil, nil, status.Errorf(codes.Internal, "error when signing the token - %s", err)
  	}
  
  	return &minter.MintOAuthTokenGrantResponse{
  		GrantToken:     signed,
  		Expiry:         google.NewTimestamp(expiry),
  		ServiceVersion: p.serviceVer,
  	}, body, nil
  }
docs: // mint is called to make the token after the request has been authorized.