don't want to publish auth credentials