Credentials are checked by the API — the token it returns expires after 12 hours.