checkCredentials should be first