code: func (k *Kontrol) generateToken(tok *token) (string, error) {
  	uniqKey := tok.String()
  
  	k.tokenCacheMu.Lock()
  	defer k.tokenCacheMu.Unlock()
  
  	if !tok.force {
  		if ct, ok := k.tokenCache[uniqKey]; ok {
  			return ct.signed, nil
  		}
  	}
  
  	rsaPrivate, err := jwt.ParseRSAPrivateKeyFromPEM([]byte(tok.keyPair.Private))
  	if err != nil {
  		return "", err
  	}
  
  	id, err := uuid.NewV4()
  	if err != nil {
  		return "", err
  	}
  
  	now := time.Now().UTC()
  
  	claims := &kitekey.KiteClaims{
  		StandardClaims: jwt.StandardClaims{
  			Issuer:    tok.issuer,
  			Subject:   tok.username,
  			Audience:  tok.audience,
  			ExpiresAt: now.Add(k.tokenTTL()).Add(k.tokenLeeway()).UTC().Unix(),
  			IssuedAt:  now.Add(-k.tokenLeeway()).UTC().Unix(),
  			Id:        id.String(),
  		},
  	}
  
  	if !k.TokenNoNBF {
  		claims.NotBefore = now.Add(-k.tokenLeeway()).Unix()
  	}
  
  	signed, err := jwt.NewWithClaims(jwt.GetSigningMethod("RS256"), claims).SignedString(rsaPrivate)
  	if err != nil {
  		return "", errors.New("Server error: Cannot generate a token")
  	}
  
  	k.cacheToken(uniqKey, signed)
  
  	return signed, nil
  }
docs: // generateToken returns a JWT token string. Please see the URL for details:
  // http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-13#section-4.1