protected OneTimeTokenAccount encode(final OneTimeTokenAccount account) {
        account.setSecretKey(toTokenCredentialCipherExecutor(account).encode(account.getSecretKey()).toString());
        val scratchCodesCipherExecutor = toScratchCodesCipherExecutor(account);
        account.setScratchCodes(account.getScratchCodes()
            .stream()
            .map(code -> FunctionUtils.doAndHandle(() -> scratchCodesCipherExecutor.encode(code), t -> code).get())
            .collect(Collectors.toList()));
        account.setUsername(account.getUsername().trim().toLowerCase(Locale.ENGLISH));
        return account;
    }
Encode.

@param account the account
@return the one time token account
support/cas-server-support-otp-mfa-core/src/main/java/org/apereo/cas/otp/repository/credentials/BaseOneTimeTokenCredentialRepository.java