user specifies key/secret when creating user