Demo-only fixed credentials. Use server-side auth in production for security [^1].