credentials as bag/item instead of canonical