Add credential secret

Also switched to OAuth, from deprecated Oauth