username and password values are considered only when an api value is not found