credentials via env vars