Rewrite the credentials api.
The credentials are now sended along with the flow.
The credentials are fetched on-demand and obfuscated.