OptionaljtiOptionalkidKey id written to the JWS header for rotation.
OptionalnowInjectable clock (ms) for deterministic tests.
Signing secret (must match the verifier's secret for this kid).
OptionalttlToken lifetime in seconds (default 7 days).
Override the unique token id (default: random UUID).