get scoped credentials in publish
test auth in both bearer and basic scenarios