code: func (s *AuthServer) rotateAndFetchSignupToken(token string) (*services.SignupToken, error) {
  	var err error
  
  	// Fetch original signup token.
  	st, err := s.GetSignupToken(token)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	// Generate and set new OTP code for user in *services.SignupToken.
  	accountName := st.User.V2().GetName() + "@" + s.AuthServiceName
  	st.OTPKey, st.OTPQRCode, err = s.initializeTOTP(accountName)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	// Upsert token into backend.
  	err = s.UpsertSignupToken(token, *st, st.Expires.Sub(s.clock.Now()))
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	return st, nil
  }
docs: // rotateAndFetchSignupToken rotates the signup token everytime it's fetched.
  // This ensures that an attacker that gains the signup link can not view it,
  // extract the OTP key from the QR code, then allow the user to signup with
  // the same OTP token.