credential can be derived