I considered adding a parameter to this function, `overwrite`, defaulting to `FALSE`...
I tried to remind myself that I was not my user, and hesitated between various use cases to support.  It could be documented that, to overwrite your credentials, delete your `CREDENTIALS_FILE` then run `set_credentials_file()`.  Because somewhere we need to document when and how to call `set_credentials_file()` anyway.  Does this make sense?
I can implement the `overwrite` option within the function if you think that's better.
In your suggestion, didn't you mean
```
if (credentials_data$username != "") {
new_credentials$username <- username
}
```
?  I think this behaviour should happen only when the user explicitly wants to overwrite their credentials, after resetting their API keys, for instance.