'Returns a JWT access token.
Arguments:
scopes (list): Scopes controlling which optional claims are included in the token.
Keyword Arguments:
expires_in (int): Time to token expiry, specified in seconds.
aud (string): Overrides configured JWT audience claim.
additional_claims (dict): Additional claims to include in the token.
Returns:
str: Encoded JWT'

def build_token(self, scopes, expires_in=None, aud=None, additional_claims=None):

    now = int(time())
    expires_in = (expires_in or self.jwt_auth['JWT_EXPIRATION'])
    payload = {'aud': (aud if aud else self.jwt_auth['JWT_AUDIENCE']), 'exp': (now + expires_in), 'iat': now, 'iss': self.jwt_auth['JWT_ISSUER'], 'preferred_username': self.user.username, 'scopes': scopes, 'sub': anonymous_id_for_user(self.user, None)}
    if additional_claims:
        payload.update(additional_claims)
    for scope in scopes:
        handler = self.claim_handlers.get(scope)
        if handler:
            handler(payload)
    return self.encode(payload)
