For consistency, let's call these `credentialToken` and `credentialSecret` (not `credentials`)