credentials support in REST API