token is now credentials_id