credentials, but protected