remove credentials from index.js