add vcr and test for both valid and invalid credentials