CJ credentials remain server-side only.