diff --git a/federation/service/node.go b/federation/service/node.go
index 436396623..4215b66cf 100644
--- a/federation/service/node.go
+++ b/federation/service/node.go
@@ -30,7 +30,7 @@ type (
 
 		actionlog actionlog.Recorder
 
-		tokenEncoder auth.TokenEncoder
+		tokenEncoder auth.TokenGenerator
 
 		name    string
 		host    string
@@ -290,14 +290,18 @@ func (svc node) Pair(ctx context.Context, nodeID uint64) error {
 				return err
 			}
 
+			var accessToken string
 			// Generate JWT token for the federated user
-			authToken := svc.tokenEncoder.Encode(u)
+			accessToken, err = svc.tokenEncoder.Generate(ctx, u)
+			if err != nil {
+				return err
+			}
 
 			n.UpdatedBy = auth.GetIdentityFromContext(ctx).Identity()
 			n.UpdatedAt = now()
 
 			// Start handshake initialization remote node
-			if err = svc.handshaker.Init(ctx, n, authToken); err != nil {
+			if err = svc.handshaker.Init(ctx, n, accessToken); err != nil {
 				return err
 			}
 
@@ -357,14 +361,15 @@ func (svc node) HandshakeConfirm(ctx context.Context, nodeID uint64) error {
 			return err
 		}
 
+		var accessToken string
 		// Generate JWT token for the federated user
-		authToken := svc.tokenEncoder.Encode(u)
+		accessToken, err = svc.tokenEncoder.Generate(ctx, u)
 
 		n.UpdatedBy = auth.GetIdentityFromContext(ctx).Identity()
 		n.UpdatedAt = now()
 
 		// Complete handshake on remote node
-		if err = svc.handshaker.Complete(ctx, n, authToken); err != nil {
+		if err = svc.handshaker.Complete(ctx, n, accessToken); err != nil {
 			return err
 		}