using get_credentials instead of get_access_token