added note about API credentials