code: func (s *AuthServer) CreateUserWithOTP(token string, password string, otpToken string) (services.WebSession, error) {
  	tokenData, err := s.GetSignupToken(token)
  	if err != nil {
  		log.Debugf("failed to get signup token: %v", err)
  		return nil, trace.AccessDenied("expired or incorrect signup token")
  	}
  
  	err = s.UpsertTOTP(tokenData.User.Name, tokenData.OTPKey)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	err = s.CheckOTP(tokenData.User.Name, otpToken)
  	if err != nil {
  		log.Debugf("failed to validate a token: %v", err)
  		return nil, trace.AccessDenied("failed to validate a token")
  	}
  
  	err = s.UpsertPassword(tokenData.User.Name, []byte(password))
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	// create services.User and services.WebSession
  	webSession, err := s.createUserAndSession(tokenData)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	return webSession, nil
  }
docs: // CreateUserWithOTP creates account with provided token and password.
  // Account username and hotp generator are taken from token data.
  // Deletes token after account creation.