separated credential handling