service principal should create credentials for itself
don't return private_key