manage credentials with environment variables