Why allow credentials other than ApiCredentials in the list? I can't think of a use case for anything else.