public String build(final JwtRequest payload) throws Throwable {
        val serviceAudience = payload.getServiceAudience();
        Objects.requireNonNull(payload.getIssuer(), "Issuer cannot be undefined");
        Objects.requireNonNull(serviceAudience, "Audience cannot be undefined");
        val claims = new JWTClaimsSet.Builder()
            .audience(new ArrayList<>(serviceAudience))
            .issuer(payload.getIssuer())
            .jwtID(payload.getJwtId())
            .issueTime(payload.getIssueDate())
            .subject(payload.getSubject());

        val attributes = collectClaims(payload);
        attributes
            .entrySet()
            .stream()
            .filter(entry -> !entry.getKey().startsWith(CentralAuthenticationService.NAMESPACE))
            .filter(entry -> !entry.getValue().isEmpty())
            .forEach(entry -> {
                val value = entry.getValue();
                var claimValue = value.size() == 1 ? CollectionUtils.firstElement(value).orElseThrow() : value;
                if (claimValue instanceof ZonedDateTime) {
                    claimValue = claimValue.toString();
                }
                claims.claim(entry.getKey(), claimValue);
            });
        claims.expirationTime(payload.getValidUntilDate());
        val claimsSet = finalizeClaims(claims.build(), payload);

        LOGGER.trace("Locating service [{}] in service registry", serviceAudience);
        val registeredService = payload.getRegisteredService()
            .orElseGet(() -> serviceAudience.stream()
                .map(this::locateRegisteredService)
                .filter(Objects::nonNull)
                .findFirst()
                .orElseThrow(() -> {
                    val formatted = "There is no application record registered with the CAS service registry that would match %s. "
                        + "Review the applications registered with the CAS service registry and make sure a matching record exists for %s.";
                    return UnauthorizedServiceException.denied(formatted.formatted(serviceAudience, serviceAudience));
                }));
        return build(registeredService, claimsSet);
    }
Build JWT.

@param payload the payload
@return the jwt
@throws Throwable the throwable
support/cas-server-support-token-core-api/src/main/java/org/apereo/cas/token/JwtBuilder.java