public Task <IOauthGrantAuthenticationResult> ExchangeAsync(IAccount account, CancellationToken cancellationToken)
        {
            var oauthExchangeJwt = _client.NewJwtBuilder()
                                   .SetSubject(account.Href)
                                   .SetIssuedAt(DateTimeOffset.UtcNow.AddSeconds(-5))
                                   .SetExpiration(DateTimeOffset.UtcNow.AddMinutes(1)) // very short
                                   .SetIssuer(_application.Href)
                                   .SetClaim("status", "AUTHENTICATED")
                                   .SetAudience(_configuration.Client.ApiKey.Id)
                                   .SignWith(_configuration.Client.ApiKey.Secret, Encoding.UTF8)
                                   .Build();

            var exchangeRequest = OauthRequests.NewIdSiteTokenAuthenticationRequest()
                                  .SetJwt(oauthExchangeJwt.ToString())
                                  .Build();

            try
            {
                return(_application
                       .NewIdSiteTokenAuthenticator()
                       .AuthenticateAsync(exchangeRequest, cancellationToken));
            }
            catch (ResourceException rex)
            {
                _logger.Warn(rex, source: nameof(StormpathTokenExchanger));

                return(Task.FromResult <IOauthGrantAuthenticationResult>(null));
            }
        }
        private async Task <IOauthGrantAuthenticationResult> ExchangeTokenAsync(IApplication application, IJwt jwt, CancellationToken cancellationToken)
        {
            try
            {
                var tokenExchangeAttempt = OauthRequests.NewIdSiteTokenAuthenticationRequest()
                                           .SetJwt(jwt.ToString())
                                           .Build();

                var grantResult = await application.NewIdSiteTokenAuthenticator()
                                  .AuthenticateAsync(tokenExchangeAttempt, cancellationToken);

                return(grantResult);
            }
            catch (ResourceException rex)
            {
                _logger.Warn(rex, source: nameof(ExchangeTokenAsync));
                throw; // json response
            }
        }