Can we add a `check(credentialToken, String)` just to be safe?