remove credential part from client-side