scoped credentials