add note on accepted credentials