check credentials