ephemeral credentials for AI