code: func (s *IdentityService) UpsertUsedTOTPToken(user string, otpToken string) error {
  	if user == "" {
  		return trace.BadParameter("missing user name")
  	}
  	item := backend.Item{
  		Key:     backend.Key(webPrefix, usersPrefix, user, usedTOTPPrefix),
  		Value:   []byte(otpToken),
  		Expires: s.Clock().Now().UTC().Add(usedTOTPTTL),
  	}
  	_, err := s.Put(context.TODO(), item)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  	return nil
  }
docs: // UpsertUsedTOTPToken upserts a TOTP token to the backend so it can't be used again
  // during the 30 second window it's valid.