@Override
    public String createToken(final PasswordManagementQuery query) {
        try {
            val issuer = casProperties.getServer().getPrefix();
            
            val token = UUID.randomUUID().toString();
            val claims = new JwtClaims();
            val resetProperties = casProperties.getAuthn().getPm().getReset();
            claims.setJwtId(token);
            claims.setIssuer(issuer);
            claims.setAudience(issuer);

            val minutes = Beans.newDuration(resetProperties.getExpiration()).toMinutes();
            claims.setExpirationTimeMinutesInTheFuture((float) minutes);
            claims.setIssuedAtToNow();

            val holder = ClientInfoHolder.getClientInfo();
            if (holder != null) {
                if (resetProperties.isIncludeServerIpAddress()) {
                    claims.setStringClaim("origin", holder.getServerIpAddress());
                }
                if (resetProperties.isIncludeClientIpAddress()) {
                    claims.setStringClaim("client", holder.getClientIpAddress());
                }
            }
            claims.setSubject(query.getUsername());
            LOGGER.debug("Creating password management token for [{}]", query.getUsername());
            val json = claims.toJson();

            LOGGER.debug("Encoding the generated JSON token...");
            return this.cipherExecutor.encode(json);
        } catch (final Exception e) {
            LoggingUtils.error(LOGGER, e);
        }
        return null;
    }
This is {@link BasePasswordManagementService}.

@author Misagh Moayyed
@since 5.1.0
support/cas-server-support-pm-core/src/main/java/org/apereo/cas/pm/impl/BasePasswordManagementService.java