routes & credentials