pub fn mint(
key: &PeerMintKey,
payload: &HandlePayload,
audience: &str,
) -> Result<String, String>Expand description
Mints one token: mh1.<base64url-nopad(payload JSON)>.<base64url-nopad(mac)>.
The audience is covered by the MAC but is not carried in the token. That is what makes a handle audience-scoped rather than pure bearer: a token scraped out of persisted message history is not by itself redeemable, because redemption also requires asserting the exact audience string it was minted for.