add sandbox credentials and app.yaml