jwt-sign.js

function getPrivateKey (path, ) {
  // buscar private key con `fs`
}

const subject = user.id
const payload = { id: user.id }

const audience = user.isAdmin
  ? ['admin']
  : ['user']

const permissions = user.isAdmin ? ['*'] : ['read']

getPrivateKey('file/private.pem', function (err, privateKey) {
  if (err) {
    return cb(new createError.InternalServerError())
  }

  const accessToken = jwt.sign(payload, privateKey, {
    issuer: config.jwt.issuer,
    algorithm: config.jwt.algorithm,
    expiresIn: config.jwt.account.expiresIn,
    audience,
    subject,
    permissions // custom claim para Authorization
  })

  return cb(null, accessToken)
})