credential lifecycle