externalised credentials