@Override
    protected String grantServiceTicket(final String ticketGrantingTicket,
                                        final WebApplicationService webApplicationService,
                                        final AuthenticationResult authenticationResult) throws Throwable {
        val registeredService = this.servicesManager.findServiceBy(webApplicationService);

        LOGGER.debug("Located registered service [{}] for [{}]", registeredService, webApplicationService);
        RegisteredServiceAccessStrategyUtils.ensureServiceAccessIsAllowed(webApplicationService, registeredService);
        val tokenAsResponse = RegisteredServiceProperties.TOKEN_AS_SERVICE_TICKET.isAssignedTo(registeredService, BooleanUtils::toBoolean);

        if (!tokenAsResponse) {
            LOGGER.debug("Service [{}] does not require JWT tickets; properties assigned are [{}]",
                webApplicationService, registeredService.getProperties());
            return super.grantServiceTicket(ticketGrantingTicket, webApplicationService, authenticationResult);
        }

        val serviceTicket = super.grantServiceTicket(ticketGrantingTicket, webApplicationService, authenticationResult);
        val jwt = tokenTicketBuilder.build(serviceTicket, webApplicationService);
        LOGGER.debug("Generated JWT [{}] for service [{}]", jwt, webApplicationService);
        return jwt;
    }
The ticket builder that produces tokens.
support/cas-server-support-rest-tokens/src/main/java/org/apereo/cas/tokens/JwtServiceTicketResourceEntityResponseFactory.java