check credentials permission