explicitly return credential