What does the API return if the credentials are incorrect?
I think you might have to do an `if (res.statusCode !== 200) { return callback(..` here