code: func (api UsersAPI) GetTOTPSecret(w http.ResponseWriter, r *http.Request) {
  	username := mux.Vars(r)["username"]
  
  	var response struct {
  		Totpsecret string `json:"totpsecret"`
  		TotpIssuer string `json:"totpissuer"`
  	}
  
  	totpManager := totp.NewManager(r)
  	err, secret := totpManager.GetSecret(username)
  	// if no existing secret is found generate a new one
  	if totpManager.IsErrNotFound(err) {
  		var token *totp.Token
  		token, err = totp.NewToken()
  		if handleServerError(w, "generating a new totp secret", err) {
  			return
  		}
  
  		response.Totpsecret = token.Secret
  		response.TotpIssuer = totp.GetIssuer(r)
  		// an error might be an `actual` error and not just a not found
  	} else if handleServerError(w, "get saved totp secret", err) {
  		return
  		// if there was no error then we successfully loaded an existing secret
  	} else {
  		response.TotpIssuer = totp.GetIssuer(r)
  		response.Totpsecret = secret.Secret
  	}
  
  	w.WriteHeader(http.StatusOK)
  	json.NewEncoder(w).Encode(response)
  }
docs: // GetTOTPSecret is the handler for GET /users/{username}/totp/
  // Gets the users TOTP secret, or a new one if it doesn't exist yet