move credentials to the server (untracked).