credentials: less magical, more dynamical