use ENV instead of hardcoding creds