move credentials to server-side