def create_token(self, response):
        s = ssh.base64url_decode(response)

        if s[0] == 'r':
            # this is a version 0 response
            version_1 = False
            if self.lowest_supported_version > 0:
                raise exceptions.ProtocolVersionError(
                    "Client needs to support at least version %d"
                    % self.lowest_supported_version
                )
            r = protocol.Response.deserialize(s)
            if not r.hmac_challenge.verify(self._hmac):
                raise exceptions.InvalidInputException(
                    "Challenge hmac verification failed, not matching  secret"
                )
            challenge = protocol.Challenge.deserialize(r.hmac_challenge.payload)
        elif s[0] == '\x01':
            # this is a version 1 response
            version_1 = True
            r = msgpack_protocol.Response.deserialize(s)
            challenge = msgpack_protocol.Challenge.deserialize_authenticated(
                r.challenge, self.secret)
        else:
            raise exceptions.ProtocolError("invalid first byte of response")

        # verify the integrity of the challenge in the response
        if self.server_name != challenge.server_name:
            s = "Got challenge with the wrong server_name encoded"
            raise exceptions.InvalidInputException(s)

        key = self.key_provider.get_key(challenge.username)

        if challenge.valid_from > self.now_func():
            s = time.strftime("%Y-%m-%d %H:%M:%S UTC",
                              time.gmtime(challenge.valid_from))
            raise exceptions.InvalidInputException("Response with challenge "
                                                   "created as %s too new "
                                                   % s)

        if challenge.valid_to < self.now_func():
            s = time.strftime("%Y-%m-%d %H:%M:%S UTC",
                              time.gmtime(challenge.valid_from))
            raise exceptions.InvalidInputException("Response with challenge "
                                                   "created as %s too old "
                                                   % s)

        if version_1:
            if not key.verify_signature(r.signature, r.challenge):
                raise exceptions.InvalidInputException(
                    "Client did not provide proof that it controls "
                    "the secret key")
        else:
            if not key.verify_signature(r.signature, r.hmac_challenge.payload):
                raise exceptions.InvalidInputException(
                    "Client did not provide proof that it controls "
                    "the secret key")

        expire_time = int(self.now_func()) + self.token_lifetime

        return self._make_token(challenge.username, expire_time)
This method verifies that the response given from the client
dataset/ETHPy150Open spotify/crtauth/crtauth/server.py/AuthServer.create_token