externalized credentials