code: func (tc *TeleportClient) directLogin(ctx context.Context, secondFactorType string, pub []byte) (*auth.SSHLoginResponse, error) {
  	var err error
  
  	var password string
  	var otpToken string
  
  	password, err = tc.AskPassword()
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	// only ask for a second factor if it's enabled
  	if secondFactorType != teleport.OFF {
  		otpToken, err = tc.AskOTP()
  		if err != nil {
  			return nil, trace.Wrap(err)
  		}
  	}
  
  	// ask the CA (via proxy) to sign our public key:
  	response, err := tc.credClient.SSHAgentLogin(
  		ctx,
  		tc.Config.Username,
  		password,
  		otpToken,
  		pub,
  		tc.KeyTTL,
  		tc.CertificateFormat)
  
  	return response, trace.Wrap(err)
  }
docs: // directLogin asks for a password + HOTP token, makes a request to CA via proxy