Derived credential handling