the claims
facts the payload cannot say, such as the session and the grant, for the token registry; never signed or sent
algorithm, header merged into the protected header, and
certificateHeader, the use case whose setting decides x5c or x5u
the compact JWS
Signs a token this service issues, RS256 by default, and records it: every OAuth token goes through here.