code: func WrapOpID(c context.Context, id int64, caller identity.Identity) (string, error) {
  	return opToken.Generate(c, []byte(caller), map[string]string{
  		"id": strconv.FormatInt(id, 10),
  	}, 0)
  }
docs: // WrapOpID returns HMAC-protected string that embeds upload operation ID.
  //
  // The string is bound to the given caller, i.e UnwrapOpID will correctly
  // validate HMAC only if it receives the exact same caller.