require credentials