code: def get_token(self):
          
          # Generate string formatted timestamps for not_before and not_after,
          # for the lifetime specified in minutes.
          now = datetime.datetime.utcnow()
          # Start the not_before time x minutes in the past, to avoid clock skew
          # issues.
          _not_before = now - datetime.timedelta(minutes=TOKEN_SKEW)
          not_before = _not_before.strftime(TIME_FORMAT)
          # Set the not_after time in the future, by the lifetime, but ensure the
          # skew we applied to not_before is taken into account.
          _not_after = now + datetime.timedelta(
              minutes=self.token_lifetime - TOKEN_SKEW
          )
          not_after = _not_after.strftime(TIME_FORMAT)
          # Generate a json string for the encryption payload contents.
          payload = json.dumps({
              'not_before': not_before,
              'not_after': not_after
          })
          token = self._get_cached_token()
          if token:
              return token
          # Generate a base64 encoded KMS encrypted token to use for
          # authentication. We encrypt the token lifetime information as the
          # payload for verification in Confidant.
          try:
              token = self.kms_client.encrypt(
                  KeyId=self.auth_key,
                  Plaintext=payload,
                  EncryptionContext=self.auth_context
              )['CiphertextBlob']
              token = base64.b64encode(ensure_bytes(token))
          except (ConnectionError, EndpointConnectionError) as e:
              logging.exception('Failure connecting to AWS: {}'.format(str(e)))
              raise ServiceConnectionError()
          except Exception:
              logging.exception('Failed to create auth token.')
              raise TokenGenerationError()
          self._cache_token(token, not_after)
          return token
docs: Get an authentication token.