code: func (s *AuthServer) GetTokens(opts ...services.MarshalOption) (tokens []services.ProvisionToken, err error) {
  	// get node tokens:
  	tokens, err = s.Provisioner.GetTokens()
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	// get static tokens:
  	tkns, err := s.GetStaticTokens()
  	if err != nil && !trace.IsNotFound(err) {
  		return nil, trace.Wrap(err)
  	}
  	if err == nil {
  		tokens = append(tokens, tkns.GetStaticTokens()...)
  	}
  	// get user tokens:
  	userTokens, err := s.Identity.GetSignupTokens()
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	// convert user tokens to machine tokens:
  	for _, t := range userTokens {
  		roles := teleport.Roles{teleport.RoleSignup}
  		tok, err := services.NewProvisionToken(t.Token, roles, t.Expires)
  		if err != nil {
  			return nil, trace.Wrap(err)
  		}
  		tokens = append(tokens, tok)
  	}
  	return tokens, nil
  }
docs: // GetTokens returns all tokens (machine provisioning ones and user invitation tokens). Machine
  // tokens usually have "node roles", like auth,proxy,node and user invitation tokens have 'signup' role