I thought that these credentials would have to be defined by partners potentially? Because of that, should we not stick the credentials in their own .js file which can be overridden by something in build/ ?