@Override
    public OAuth20Code create(final Service service,
                              final Authentication authentication,
                              final Ticket ticketGrantingTicket,
                              final Collection<String> scopes,
                              final String codeChallenge,
                              final String codeChallengeMethod,
                              final String clientId,
                              final Map<String, Map<String, Object>> requestClaims,
                              final OAuth20ResponseTypes responseType,
                              final OAuth20GrantTypes grantType) throws Throwable {

        val expirationPolicyToUse = determineExpirationPolicyForService(clientId);
        val codeId = oAuthCodeIdGenerator.getNewTicketId(OAuth20Code.PREFIX);

        val codeIdToUse = FunctionUtils.doIf(cipherExecutor.isEnabled(), () -> {
            LOGGER.trace("Attempting to encode OAuth code [{}]", codeId);
            val encoded = cipherExecutor.encode(codeId);
            LOGGER.debug("Encoded OAuth code [{}]", encoded);
            return encoded;
        }, () -> codeId).get();

        val oauthCode = new OAuth20DefaultCode(codeIdToUse, service, authentication,
            expirationPolicyToUse, ticketGrantingTicket, scopes,
            codeChallenge, codeChallengeMethod, clientId,
            requestClaims, responseType, grantType);
        FunctionUtils.doIfNotNull(service, __ -> oauthCode.setTenantId(service.getTenant()));
        descendantTicketsTrackingPolicy.trackTicket(ticketGrantingTicket, oauthCode);
        return oauthCode;
    }
Cipher to sign/encrypt codes, if enabled.
support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/ticket/code/OAuth20DefaultOAuthCodeFactory.java