code: func (rd *Redirector) callback(w http.ResponseWriter, r *http.Request) (*auth.SSHLoginResponse, error) {
  	if r.URL.Path != "/callback" {
  		return nil, trace.NotFound("path not found")
  	}
  
  	// Decrypt ciphertext to get login response.
  	plaintext, err := rd.key.Open([]byte(r.URL.Query().Get("response")))
  	if err != nil {
  		return nil, trace.BadParameter("failed to decrypt response: in %v, err: %v", r.URL.String(), err)
  	}
  
  	var re *auth.SSHLoginResponse
  	err = json.Unmarshal(plaintext, &re)
  	if err != nil {
  		return nil, trace.BadParameter("failed to decrypt response: in %v, err: %v", r.URL.String(), err)
  	}
  
  	return re, nil
  }
docs: // callback is used by Teleport proxy to send back credentials
  // issued by Teleport proxy