credentials provided by service layer