allow callable credentials retrieval