credential: handle invalid arguments earlier