expose credentials from client