This function is a little clumsy.
You give it four parameters but 'options' and 'res' only are ad hoc parameters for 'callback'.
If we are calling 'createToken' with a 'callback' parameter which do not need any 'options' or 'res' we find ourselves giving it two 'undef' values... It's pretty ugly.
Maybe you should only give the created token to the callback and handle other needed parameters with a closure ?