code: func (s *ProvisioningService) GetTokens(opts ...services.MarshalOption) ([]services.ProvisionToken, error) {
  	startKey := backend.Key(tokensPrefix)
  	result, err := s.GetRange(context.TODO(), startKey, backend.RangeEnd(startKey), backend.NoLimit)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	tokens := make([]services.ProvisionToken, len(result.Items))
  	for i, item := range result.Items {
  		t, err := services.UnmarshalProvisionToken(item.Value,
  			services.AddOptions(opts, services.SkipValidation(),
  				services.WithResourceID(item.ID), services.WithExpires(item.Expires))...)
  		if err != nil {
  			return nil, trace.Wrap(err)
  		}
  		tokens[i] = t
  	}
  	return tokens, nil
  }
docs: // GetTokens returns all active (non-expired) provisioning tokens