code: func (c *TokenCommand) Add(client auth.ClientI) error {
  	// Parse string to see if it's a type of role that Teleport supports.
  	roles, err := teleport.ParseRoles(c.tokenType)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  
  	// Generate token.
  	token, err := client.GenerateToken(auth.GenerateTokenRequest{
  		Roles: roles,
  		TTL:   c.ttl,
  		Token: c.value,
  	})
  	if err != nil {
  		return trace.Wrap(err)
  	}
  
  	// Calculate the CA pin for this cluster. The CA pin is used by the client
  	// to verify the identity of the Auth Server.
  	caPin, err := calculateCAPin(client)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  
  	// Get list of auth servers. Used to print friendly signup message.
  	authServers, err := client.GetAuthServers()
  	if err != nil {
  		return trace.Wrap(err)
  	}
  	if len(authServers) == 0 {
  		return trace.Errorf("this cluster has no auth servers")
  	}
  
  	// Print signup message.
  	switch {
  	case roles.Include(teleport.RoleTrustedCluster), roles.Include(teleport.LegacyClusterTokenType):
  		fmt.Printf(trustedClusterMessage,
  			token,
  			int(c.ttl.Minutes()))
  	default:
  		fmt.Printf(nodeMessage,
  			token,
  			int(c.ttl.Minutes()),
  			strings.ToLower(roles.String()),
  			token,
  			caPin,
  			authServers[0].GetAddr(),
  			int(c.ttl.Minutes()),
  			authServers[0].GetAddr())
  	}
  
  	return nil
  }
docs: // Add is called to execute "tokens add ..." command.