diff --git a/src/Kuzzle.js b/src/Kuzzle.js
index 40c26f24b..c40dccea2 100644
--- a/src/Kuzzle.js
+++ b/src/Kuzzle.js
@@ -520,6 +520,128 @@ Kuzzle.prototype.login = function (strategy) {
   });
 };
 
+/**
+ * Create credentials of the specified <strategy> for the current user.
+ *
+ * @param credentials
+ * @param strategy
+ * @param options
+ * @param cb
+ * @returns {Kuzzle}
+ */
+Kuzzle.prototype.createMyCredentials = function (strategy, credentials, options, cb) {
+  if (!cb && typeof options === 'function') {
+    cb = options;
+    options = null;
+  }
+
+  this.query({controller: 'auth', action: 'createMyCredentials'}, {strategy: strategy, body: credentials}, options, function(err, res) {
+    if (!err) {
+      cb && cb(null, res.result._source);
+    } else {
+      cb && cb(err);
+    }
+  });
+
+  return this;
+};
+
+/**
+ * Delete credentials of the specified <strategy> for the current user.
+ *
+ * @param strategy
+ * @param options
+ * @param cb
+ * @returns {Kuzzle}
+ */
+Kuzzle.prototype.deleteMyCredentials = function (strategy, options, cb) {
+  if (!cb && typeof options === 'function') {
+    cb = options;
+    options = null;
+  }
+
+  this.query({controller: 'auth', action: 'deleteMyCredentials'}, {strategy: strategy}, options, typeof cb !== 'function' ? null : function(err, res) {
+    if (!err) {
+      cb && cb(null, res.result);
+    } else {
+      cb && cb(err);
+    }
+  });
+
+  return this;
+};
+
+/**
+ * Get credential information of the specified <strategy> for the current user.
+ *
+ * @param strategy
+ * @param options
+ * @param cb
+ */
+Kuzzle.prototype.getMyCredentials = function (strategy, options, cb) {
+  if (!cb && typeof options === 'function') {
+    cb = options;
+    options = null;
+  }
+
+  this.query({controller: 'auth', action: 'getMyCredentials'}, {strategy: strategy}, options, typeof cb !== 'function' ? null : function(err, res) {
+    if (!err) {
+      cb && cb(null, res.result);
+    } else {
+      cb && cb(err);
+    }
+  });
+};
+
+/**
+ * Update credentials of the specified <strategy> for the current user.
+ *
+ * @param strategy
+ * @param credentals
+ * @param options
+ * @param cb
+ * @returns {Kuzzle}
+ */
+Kuzzle.prototype.updateMyCredentials = function (strategy, credentials, options, cb) {
+  if (!cb && typeof options === 'function') {
+    cb = options;
+    options = null;
+  }
+
+  this.query({controller: 'auth', action: 'updateMyCredentials'}, {strategy: strategy, body: credentials}, options, typeof cb !== 'function' ? null : function(err, res) {
+    if (!err) {
+      cb && cb(null, res.result);
+    } else {
+      cb && cb(err);
+    }
+  });
+
+  return this;
+};
+
+/**
+ * Validate credentials of the specified <strategy> for the current user.
+ *
+ * @param strategy
+ * @param credentials
+ * @param options
+ * @param cb
+ */
+Kuzzle.prototype.validateMyCredentials = function (strategy, credentials, options, cb) {
+  if (!cb && typeof options === 'function') {
+    cb = options;
+    options = null;
+  }
+
+  this.query({controller: 'auth', action: 'validateMyCredentials'}, {strategy: strategy, body: credentials}, options, typeof cb !== 'function' ? null : function(err, res) {
+    if (!err) {
+      cb && cb(null, res.result);
+    } else {
+      cb && cb(err);
+    }
+  });
+};
+
 /**
  * Create a kuzzle index
  *
diff --git a/src/security/Security.js b/src/security/Security.js
index e606c0b77..b60ca5caf 100644
--- a/src/security/Security.js
+++ b/src/security/Security.js
@@ -751,4 +751,197 @@ Security.prototype.getUserRights = function (userId, options, cb) {
   });
 };
 
+/**
+ * Create credentials of the specified <strategy> for the user <kuid>.
+ *
+ * @param strategy
+ * @param kuid
+ * @param credentials
+ * @param options
+ * @param cb
+ * @returns {Security}
+ */
+Security.prototype.createCredentials = function (strategy, kuid, credentials, options, cb) {
+  if (!cb && typeof options === 'function') {
+    cb = options;
+    options = null;
+  }
+
+  this.kuzzle.query({controller: 'security', action: 'createCredentials'}, {_id: kuid, strategy: strategy, body: credentials}, options, function(err, res) {
+    if (!err) {
+      cb && cb(null, res.result._source);
+    } else {
+      cb && cb(err);
+    }
+  });
+
+  return this;
+};
+
+/**
+ * Delete credentials of the specified <strategy> for the user <kuid> .
+ *
+ * @param strategy
+ * @param kuid
+ * @param options
+ * @param cb
+ * @returns {Security}
+ */
+Security.prototype.deleteCredentials = function (strategy, kuid, options, cb) {
+  if (!cb && typeof options === 'function') {
+    cb = options;
+    options = null;
+  }
+
+  this.kuzzle.query({controller: 'security', action: 'deleteCredentials'}, {strategy: strategy, _id: kuid}, options, typeof cb !== 'function' ? null : function(err, res) {
+    if (!err) {
+      cb && cb(null, res.result);
+    } else {
+      cb && cb(err);
+    }
+  });
+
+  return this;
+};
+
+/**
+ * Retrieve a list of accepted fields per authentication strategy.
+ *
+ * @param options
+ * @param cb
+ */
+Security.prototype.getAllCredentialFields = function (options, cb) {
+  if (!cb && typeof options === 'function') {
+    cb = options;
+    options = null;
+  }
+
+  this.kuzzle.query({controller: 'security', action: 'getAllCredentialFields'}, {}, options, typeof cb !== 'function' ? null : function(err, res) {
+    if (!err) {
+      cb && cb(null, res.result);
+    } else {
+      cb && cb(err);
+    }
+  });
+};
+
+/**
+ * Retrieve the list of accepted field names by the specified <strategy>.
+ *
+ * @param strategy
+ * @param options
+ * @param cb
+ */
+Security.prototype.getCredentialFields = function (strategy, options, cb) {
+  if (!cb && typeof options === 'function') {
+    cb = options;
+    options = null;
+  }
+
+  this.kuzzle.query({controller: 'security', action: 'getCredentialFields'}, {strategy: strategy}, options, typeof cb !== 'function' ? null : function(err, res) {
+    if (!err) {
+      cb && cb(null, res.result);
+    } else {
+      cb && cb(err);
+    }
+  });
+};
+
+/**
+ * Get credential information of the specified <strategy> for the user <kuid>.
+ *
+ * @param strategy
+ * @param kuid
+ * @param options
+ * @param cb
+ */
+Security.prototype.getCredentials = function (strategy, kuid, options, cb) {
+  if (!cb && typeof options === 'function') {
+    cb = options;
+    options = null;
+  }
+
+  this.kuzzle.query({controller: 'security', action: 'getCredentials'}, {strategy: strategy, _id: kuid}, options, typeof cb !== 'function' ? null : function(err, res) {
+    if (!err) {
+      cb && cb(null, res.result);
+    } else {
+      cb && cb(err);
+    }
+  });
+};
+
+/**
+ * Check the existence of the specified <strategy>’s credentials for the user <kuid>.
+ *
+ * @param strategy
+ * @param kuid
+ * @param options
+ * @param cb
+ */
+Security.prototype.hasCredentials = function (strategy, kuid, options, cb) {
+  if (!cb && typeof options === 'function') {
+    cb = options;
+    options = null;
+  }
+
+  this.kuzzle.query({controller: 'security', action: 'hasCredentials'}, {strategy: strategy, _id: kuid}, options, typeof cb !== 'function' ? null : function(err, res) {
+    if (!err) {
+      cb && cb(null, res.result);
+    } else {
+      cb && cb(err);
+    }
+  });
+};
+
+/**
+ * Updates credentials of the specified <strategy> for the user <kuid>.
+ *
+ * @param strategy
+ * @param kuid
+ * @param credentials
+ * @param options
+ * @param cb
+ * @returns {Security}
+ */
+Security.prototype.updateCredentials = function (strategy, kuid, credentials, options, cb) {
+  if (!cb && typeof options === 'function') {
+    cb = options;
+    options = null;
+  }
+
+  this.kuzzle.query({controller: 'security', action: 'updateCredentials'}, {strategy: strategy, _id: kuid, body: credentials}, options, typeof cb !== 'function' ? null : function(err, res) {
+    if (!err) {
+      cb && cb(null, res.result);
+    } else {
+      cb && cb(err);
+    }
+  });
+
+  return this;
+};
+
+/**
+ * Validate credentials of the specified <strategy> for the user <kuid>.
+ *
+ * @param strategy
+ * @param kuid
+ * @param credentials
+ * @param options
+ * @param cb
+ */
+Security.prototype.validateCredentials = function (strategy, kuid, credentials, options, cb) {
+  if (!cb && typeof options === 'function') {
+    cb = options;
+    options = null;
+  }
+
+  this.kuzzle.query({controller: 'security', action: 'validateCredentials'}, {strategy: strategy, _id: kuid, body: credentials}, options, typeof cb !== 'function' ? null : function(err, res) {
+    if (!err) {
+      cb && cb(null, res.result);
+    } else {
+      cb && cb(err);
+    }
+  });
+};
+
 module.exports = Security;
diff --git a/test/kuzzle/methods.test.js b/test/kuzzle/methods.test.js
index 58afc4580..a3fa4335e 100644
--- a/test/kuzzle/methods.test.js
+++ b/test/kuzzle/methods.test.js
@@ -1043,4 +1043,223 @@ describe('Kuzzle methods', function () {
 
   });
 
+  describe('#createMyCredentials', function() {
+    beforeEach(function() {
+      kuzzle = new Kuzzle('foo');
+    });
+
+    it('should trigger callback with an error', function (done) {
+      var
+        cberror = {message: 'i am an error'},
+        spy = sandbox.stub(kuzzle, 'query').yields(cberror),
+        args;
+
+      kuzzle.createMyCredentials('strategy', {foo: 'bar'}, function (err) {
+        should(err).be.exactly(cberror);
+        args = spy.firstCall.args;
+
+        should(spy.calledOnce).be.true();
+
+        should(args[0].controller).be.exactly('auth');
+        should(args[0].action).be.exactly('createMyCredentials');
+        should(args[2]).be.exactly(null);
+        done();
+      });
+    });
+
+    it('should call query with right arguments', function (done) {
+      var
+        doc = {_id: '42'},
+        spy = sandbox.stub(kuzzle, 'query').yields(null, {result: {_source: doc}}),
+        args;
+
+      kuzzle.createMyCredentials('strategy', {foo: 'bar'}, function (err, res) {
+        should(res).be.exactly(doc);
+        args = spy.firstCall.args;
+
+        should(spy.calledOnce).be.true();
+
+        should(args[0].controller).be.exactly('auth');
+        should(args[0].action).be.exactly('createMyCredentials');
+        should(args[2]).be.exactly(null);
+        done();
+      });
+    });
+  });
+
+  describe('#deleteMyCredentials', function() {
+    beforeEach(function() {
+      kuzzle = new Kuzzle('foo');
+    });
+
+    it('should trigger callback with an error', function (done) {
+      var
+        cberror = {message: 'i am an error'},
+        spy = sandbox.stub(kuzzle, 'query').yields(cberror),
+        args;
+
+      kuzzle.deleteMyCredentials('strategy', function (err) {
+        should(err).be.exactly(cberror);
+        args = spy.firstCall.args;
+
+        should(spy.calledOnce).be.true();
+
+        should(args[0].controller).be.exactly('auth');
+        should(args[0].action).be.exactly('deleteMyCredentials');
+        should(args[2]).be.exactly(null);
+        done();
+      });
+    });
+
+    it('should call query with right arguments', function (done) {
+      var
+        spy = sandbox.stub(kuzzle, 'query').yields(null, {result: {acknowledged: true}}),
+        args;
+
+      kuzzle.deleteMyCredentials('strategy', function (err, res) {
+        should(res.acknowledged).be.exactly(true);
+        args = spy.firstCall.args;
+
+        should(spy.calledOnce).be.true();
+
+        should(args[0].controller).be.exactly('auth');
+        should(args[0].action).be.exactly('deleteMyCredentials');
+        should(args[2]).be.exactly(null);
+        done();
+      });
+    });
+  });
+
+  describe('#getMyCredentials', function() {
+    beforeEach(function() {
+      kuzzle = new Kuzzle('foo');
+    });
+
+    it('should trigger callback with an error', function (done) {
+      var
+        cberror = {message: 'i am an error'},
+        spy = sandbox.stub(kuzzle, 'query').yields(cberror),
+        args;
+
+      kuzzle.getMyCredentials('strategy', function (err) {
+        should(err).be.exactly(cberror);
+        args = spy.firstCall.args;
+
+        should(spy.calledOnce).be.true();
+
+        should(args[0].controller).be.exactly('auth');
+        should(args[0].action).be.exactly('getMyCredentials');
+        should(args[2]).be.exactly(null);
+        done();
+      });
+    });
+
+    it('should call query with right arguments', function (done) {
+      var
+        doc = {_id: '42'},
+        spy = sandbox.stub(kuzzle, 'query').yields(null, {result: doc}),
+        args;
+
+      kuzzle.getMyCredentials('strategy', function (err, res) {
+        should(res).be.exactly(doc);
+        args = spy.firstCall.args;
+
+        should(spy.calledOnce).be.true();
+
+        should(args[0].controller).be.exactly('auth');
+        should(args[0].action).be.exactly('getMyCredentials');
+        should(args[2]).be.exactly(null);
+        done();
+      });
+    });
+  });
+
+  describe('#updateMyCredentials', function() {
+    beforeEach(function() {
+      kuzzle = new Kuzzle('foo');
+    });
+
+    it('should trigger callback with an error', function (done) {
+      var
+        cberror = {message: 'i am an error'},
+        spy = sandbox.stub(kuzzle, 'query').yields(cberror),
+        args;
+
+      kuzzle.updateMyCredentials('strategy', {username: 'foo'}, function (err) {
+        should(err).be.exactly(cberror);
+        args = spy.firstCall.args;
+
+        should(spy.calledOnce).be.true();
+
+        should(args[0].controller).be.exactly('auth');
+        should(args[0].action).be.exactly('updateMyCredentials');
+        should(args[2]).be.exactly(null);
+        done();
+      });
+    });
+
+    it('should call query with right arguments', function (done) {
+      var
+        doc = {username: 'foo'},
+        spy = sandbox.stub(kuzzle, 'query').yields(null, {result: doc}),
+        args;
+
+      kuzzle.updateMyCredentials('strategy', doc, function (err, res) {
+        should(res).be.exactly(doc);
+        args = spy.firstCall.args;
+
+        should(spy.calledOnce).be.true();
+
+        should(args[0].controller).be.exactly('auth');
+        should(args[0].action).be.exactly('updateMyCredentials');
+        should(args[2]).be.exactly(null);
+        done();
+      });
+    });
+  });
+
+  describe('#validateMyCredentials', function() {
+    beforeEach(function() {
+      kuzzle = new Kuzzle('foo');
+    });
+
+    it('should trigger callback with an error', function (done) {
+      var
+        cberror = {message: 'i am an error'},
+        spy = sandbox.stub(kuzzle, 'query').yields(cberror),
+        args;
+
+      kuzzle.validateMyCredentials('strategy', {username: 'foo'}, function (err) {
+        should(err).be.exactly(cberror);
+        args = spy.firstCall.args;
+
+        should(spy.calledOnce).be.true();
+
+        should(args[0].controller).be.exactly('auth');
+        should(args[0].action).be.exactly('validateMyCredentials');
+        should(args[2]).be.exactly(null);
+        done();
+      });
+    });
+
+    it('should call query with right arguments', function (done) {
+      var
+        doc = {username: 'foo'},
+        spy = sandbox.stub(kuzzle, 'query').yields(null, {result: true}),
+        args;
+
+      kuzzle.validateMyCredentials('strategy', doc, function (err, res) {
+        should(res).be.exactly(true);
+        args = spy.firstCall.args;
+
+        should(spy.calledOnce).be.true();
+
+        should(args[0].controller).be.exactly('auth');
+        should(args[0].action).be.exactly('validateMyCredentials');
+        should(args[2]).be.exactly(null);
+        done();
+      });
+    });
+  });
+
 });
diff --git a/test/security/kuzzleSecurity/credentialsMethods.test.js b/test/security/kuzzleSecurity/credentialsMethods.test.js
new file mode 100644
index 000000000..6ec202c28
--- /dev/null
+++ b/test/security/kuzzleSecurity/credentialsMethods.test.js
@@ -0,0 +1,355 @@
+var
+  should = require('should'),
+  sinon = require('sinon'),
+  sandbox = sinon.sandbox.create(),
+  Kuzzle = require('../../../src/Kuzzle');
+
+describe('Credentials methods', function() {
+  var kuzzle;
+
+  describe('#createCredentials', function() {
+    beforeEach(function() {
+      kuzzle = new Kuzzle('foo');
+    });
+
+    it('should trigger callback with an error', function (done) {
+      var
+        cberror = {message: 'i am an error'},
+        spy = sandbox.stub(kuzzle, 'query').yields(cberror),
+        args;
+
+      kuzzle.security.createCredentials('strategy', 'kuid', {foo: 'bar'}, function (err) {
+        should(err).be.exactly(cberror);
+        args = spy.firstCall.args;
+
+        should(spy.calledOnce).be.true();
+        should(args[0].controller).be.exactly('security');
+        should(args[0].action).be.exactly('createCredentials');
+        should(args[2]).be.exactly(null);
+        done();
+      });
+
+    });
+
+    it('should call query with right arguments', function (done) {
+      var
+        doc = {_id: '42'},
+        spy = sandbox.stub(kuzzle, 'query').yields(null, {result: {_source: doc}}),
+        args;
+
+      kuzzle.security.createCredentials('strategy', 'kuid', {foo: 'bar'}, function (err, res) {
+        should(res).be.exactly(doc);
+        args = spy.firstCall.args;
+
+        should(spy.calledOnce).be.true();
+
+        should(args[0].controller).be.exactly('security');
+        should(args[0].action).be.exactly('createCredentials');
+        should(args[2]).be.exactly(null);
+        done();
+      });
+    });
+  });
+
+  describe('#deleteCredentials', function() {
+    beforeEach(function() {
+      kuzzle = new Kuzzle('foo');
+    });
+
+    it('should trigger callback with an error', function (done) {
+      var
+        cberror = {message: 'i am an error'},
+        spy = sandbox.stub(kuzzle, 'query').yields(cberror),
+        args;
+
+      kuzzle.security.deleteCredentials('strategy', 'kuid', function (err) {
+        should(err).be.exactly(cberror);
+        args = spy.firstCall.args;
+
+        should(spy.calledOnce).be.true();
+        should(args[0].controller).be.exactly('security');
+        should(args[0].action).be.exactly('deleteCredentials');
+        should(args[2]).be.exactly(null);
+        done();
+      });
+
+    });
+
+    it('should call query with right arguments', function (done) {
+      var
+        spy = sandbox.stub(kuzzle, 'query').yields(null, {result: {acknowledged: true}}),
+        args;
+
+      kuzzle.security.deleteCredentials('strategy', 'kuid', function (err, res) {
+        should(res.acknowledged).be.exactly(true);
+        args = spy.firstCall.args;
+
+        should(spy.calledOnce).be.true();
+
+        should(args[0].controller).be.exactly('security');
+        should(args[0].action).be.exactly('deleteCredentials');
+        should(args[2]).be.exactly(null);
+        done();
+      });
+    });
+  });
+
+  describe('#getAllCredentialFields', function() {
+    beforeEach(function() {
+      kuzzle = new Kuzzle('foo');
+    });
+
+    it('should trigger callback with an error', function (done) {
+      var
+        cberror = {message: 'i am an error'},
+        spy = sandbox.stub(kuzzle, 'query').yields(cberror),
+        args;
+
+      kuzzle.security.getAllCredentialFields(function (err) {
+        should(err).be.exactly(cberror);
+        args = spy.firstCall.args;
+
+        should(spy.calledOnce).be.true();
+
+        should(args[0].controller).be.exactly('security');
+        should(args[0].action).be.exactly('getAllCredentialFields');
+        done();
+      });
+    });
+
+    it('should call query with right arguments', function (done) {
+      var
+        doc = ['usernae'],
+        spy = sandbox.stub(kuzzle, 'query').yields(null, {result: doc}),
+        args;
+
+      kuzzle.security.getAllCredentialFields(function (err, res) {
+        should(res).be.exactly(doc);
+        args = spy.firstCall.args;
+
+        should(spy.calledOnce).be.true();
+
+        should(args[0].controller).be.exactly('security');
+        should(args[0].action).be.exactly('getAllCredentialFields');
+        done();
+      });
+    });
+  });
+
+  describe('#getCredentialFields', function() {
+    beforeEach(function() {
+      kuzzle = new Kuzzle('foo');
+    });
+
+    it('should trigger callback with an error', function (done) {
+      var
+        cberror = {message: 'i am an error'},
+        spy = sandbox.stub(kuzzle, 'query').yields(cberror),
+        args;
+
+      kuzzle.security.getCredentialFields('strategy', function (err) {
+        should(err).be.exactly(cberror);
+        args = spy.firstCall.args;
+
+        should(spy.calledOnce).be.true();
+
+        should(args[0].controller).be.exactly('security');
+        should(args[0].action).be.exactly('getCredentialFields');
+        done();
+      });
+    });
+
+    it('should call query with right arguments', function (done) {
+      var
+        doc = ['usernae'],
+        spy = sandbox.stub(kuzzle, 'query').yields(null, {result: doc}),
+        args;
+
+      kuzzle.security.getCredentialFields('strategy', function (err, res) {
+        should(res).be.exactly(doc);
+        args = spy.firstCall.args;
+
+        should(spy.calledOnce).be.true();
+
+        should(args[0].controller).be.exactly('security');
+        should(args[0].action).be.exactly('getCredentialFields');
+        done();
+      });
+    });
+  });
+
+  describe('#getCredentials', function() {
+    beforeEach(function() {
+      kuzzle = new Kuzzle('foo');
+    });
+
+    it('should trigger callback with an error', function (done) {
+      var
+        cberror = {message: 'i am an error'},
+        spy = sandbox.stub(kuzzle, 'query').yields(cberror),
+        args;
+
+      kuzzle.security.getCredentials('strategy', 'kuid', function (err) {
+        should(err).be.exactly(cberror);
+        args = spy.firstCall.args;
+
+        should(spy.calledOnce).be.true();
+
+        should(args[0].controller).be.exactly('security');
+        should(args[0].action).be.exactly('getCredentials');
+        should(args[2]).be.exactly(null);
+        done();
+      });
+    });
+
+    it('should call query with right arguments', function (done) {
+      var
+        doc = {_id: '42'},
+        spy = sandbox.stub(kuzzle, 'query').yields(null, {result: doc}),
+        args;
+
+      kuzzle.security.getCredentials('strategy', 'kuid', function (err, res) {
+        should(res).be.exactly(doc);
+        args = spy.firstCall.args;
+
+        should(spy.calledOnce).be.true();
+
+        should(args[0].controller).be.exactly('security');
+        should(args[0].action).be.exactly('getCredentials');
+        should(args[2]).be.exactly(null);
+        done();
+      });
+    });
+  });
+
+  describe('#hasCredentials', function() {
+    beforeEach(function() {
+      kuzzle = new Kuzzle('foo');
+    });
+
+    it('should trigger callback with an error', function (done) {
+      var
+        cberror = {message: 'i am an error'},
+        spy = sandbox.stub(kuzzle, 'query').yields(cberror),
+        args;
+
+      kuzzle.security.hasCredentials('strategy', 'kuid', function (err) {
+        should(err).be.exactly(cberror);
+        args = spy.firstCall.args;
+
+        should(spy.calledOnce).be.true();
+
+        should(args[0].controller).be.exactly('security');
+        should(args[0].action).be.exactly('hasCredentials');
+        should(args[2]).be.exactly(null);
+        done();
+      });
+    });
+
+    it('should call query with right arguments', function (done) {
+      var
+        spy = sandbox.stub(kuzzle, 'query').yields(null, {result: true}),
+        args;
+
+      kuzzle.security.hasCredentials('strategy', 'kuid', function (err, res) {
+        should(res).be.exactly(true);
+        args = spy.firstCall.args;
+
+        should(spy.calledOnce).be.true();
+
+        should(args[0].controller).be.exactly('security');
+        should(args[0].action).be.exactly('hasCredentials');
+        should(args[2]).be.exactly(null);
+        done();
+      });
+    });
+  });
+
+  describe('#updateCredentials', function() {
+    beforeEach(function() {
+      kuzzle = new Kuzzle('foo');
+    });
+
+    it('should trigger callback with an error', function (done) {
+      var
+        cberror = {message: 'i am an error'},
+        spy = sandbox.stub(kuzzle, 'query').yields(cberror),
+        args;
+
+      kuzzle.security.updateCredentials('strategy', 'kuid', {username: 'foo'}, function (err) {
+        should(err).be.exactly(cberror);
+        args = spy.firstCall.args;
+
+        should(spy.calledOnce).be.true();
+
+        should(args[0].controller).be.exactly('security');
+        should(args[0].action).be.exactly('updateCredentials');
+        should(args[2]).be.exactly(null);
+        done();
+      });
+    });
+
+    it('should call query with right arguments', function (done) {
+      var
+        doc = {username: 'foo'},
+        spy = sandbox.stub(kuzzle, 'query').yields(null, {result: doc}),
+        args;
+
+      kuzzle.security.updateCredentials('strategy', 'kuid', doc, function (err, res) {
+        should(res).be.exactly(doc);
+        args = spy.firstCall.args;
+
+        should(spy.calledOnce).be.true();
+
+        should(args[0].controller).be.exactly('security');
+        should(args[0].action).be.exactly('updateCredentials');
+        should(args[2]).be.exactly(null);
+        done();
+      });
+    });
+  });
+
+  describe('#validateCredentials', function() {
+    beforeEach(function() {
+      kuzzle = new Kuzzle('foo');
+    });
+
+    it('should trigger callback with an error', function (done) {
+      var
+        cberror = {message: 'i am an error'},
+        spy = sandbox.stub(kuzzle, 'query').yields(cberror),
+        args;
+
+      kuzzle.security.validateCredentials('strategy', 'kuid', {username: 'foo'}, function (err) {
+        should(err).be.exactly(cberror);
+        args = spy.firstCall.args;
+
+        should(spy.calledOnce).be.true();
+
+        should(args[0].controller).be.exactly('security');
+        should(args[0].action).be.exactly('validateCredentials');
+        should(args[2]).be.exactly(null);
+        done();
+      });
+    });
+
+    it('should call query with right arguments', function (done) {
+      var
+        doc = {username: 'foo'},
+        spy = sandbox.stub(kuzzle, 'query').yields(null, {result: true}),
+        args;
+
+      kuzzle.security.validateCredentials('strategy', 'kuid', doc, function (err, res) {
+        should(res).be.exactly(true);
+        args = spy.firstCall.args;
+
+        should(spy.calledOnce).be.true();
+
+        should(args[0].controller).be.exactly('security');
+        should(args[0].action).be.exactly('validateCredentials');
+        should(args[2]).be.exactly(null);
+        done();
+      });
+    });
+  });
+});