read credentials from env vars