Making credentials actually work