credentials stored in app not in DB