diff --git a/r2dbc-spi/src/main/java/io/r2dbc/spi/ConnectionFactoryOptions.java b/r2dbc-spi/src/main/java/io/r2dbc/spi/ConnectionFactoryOptions.java
index cedb6be..be80455 100644
--- a/r2dbc-spi/src/main/java/io/r2dbc/spi/ConnectionFactoryOptions.java
+++ b/r2dbc-spi/src/main/java/io/r2dbc/spi/ConnectionFactoryOptions.java
@@ -16,6 +16,8 @@
 
 package io.r2dbc.spi;
 
+import org.reactivestreams.Publisher;
+
 import java.time.Duration;
 import java.util.ArrayList;
 import java.util.HashMap;
@@ -106,6 +108,11 @@ public final class ConnectionFactoryOptions {
      */
     public static final Option<Duration> STATEMENT_TIMEOUT = Option.valueOf("statementTimeout");
 
+    /**
+     * A Credential publisher, which supports dynamic credential usage.
+     */
+    public static final Option<Publisher<? extends Credential>> CREDENTIAL_PUBLISHER = Option.valueOf("credentialPublisher");
+
     /**
      * User for authentication.
      */
diff --git a/r2dbc-spi/src/main/java/io/r2dbc/spi/Credential.java b/r2dbc-spi/src/main/java/io/r2dbc/spi/Credential.java
new file mode 100644
index 0000000..108d9e8
--- /dev/null
+++ b/r2dbc-spi/src/main/java/io/r2dbc/spi/Credential.java
@@ -0,0 +1,11 @@
+package io.r2dbc.spi;
+
+/**
+ * Credentials used to authenticate with a database. Credential objects are
+ * mutable. Mutability allows any security sensitive values retained by a
+ * {@code Credential} to be cleared from memory. Drivers MUST NOT retain a
+ * reference to a {@code Credential} object after consuming it for database
+ * authentication.
+ */
+interface Credential {
+}
\ No newline at end of file
diff --git a/r2dbc-spi/src/main/java/io/r2dbc/spi/CredentialFactory.java b/r2dbc-spi/src/main/java/io/r2dbc/spi/CredentialFactory.java
new file mode 100644
index 0000000..07e7b25
--- /dev/null
+++ b/r2dbc-spi/src/main/java/io/r2dbc/spi/CredentialFactory.java
@@ -0,0 +1,16 @@
+package io.r2dbc.spi;
+
+/** Factory for creating {@link Credential} objects */
+public class CredentialFactory {
+
+    /**
+     * Returns a new {@link UserPasswordCredential}
+     * @param user Username. Not null.
+     * @param password Password. Not null.
+     */
+    public static UserPasswordCredential createUserPasswordCredential(
+            String user, CharSequence password) {
+        return new UserPasswordCredentialImpl(user, password);
+    }
+
+}
diff --git a/r2dbc-spi/src/main/java/io/r2dbc/spi/UserPasswordCredential.java b/r2dbc-spi/src/main/java/io/r2dbc/spi/UserPasswordCredential.java
new file mode 100644
index 0000000..bd3fbf6
--- /dev/null
+++ b/r2dbc-spi/src/main/java/io/r2dbc/spi/UserPasswordCredential.java
@@ -0,0 +1,9 @@
+package io.r2dbc.spi;
+
+/**
+ * UserPasswordCredentials used to authenticate with a database.
+ */
+public interface UserPasswordCredential extends Credential {
+    String user();
+    CharSequence password();
+}
diff --git a/r2dbc-spi/src/main/java/io/r2dbc/spi/UserPasswordCredentialImpl.java b/r2dbc-spi/src/main/java/io/r2dbc/spi/UserPasswordCredentialImpl.java
new file mode 100644
index 0000000..e44d2d4
--- /dev/null
+++ b/r2dbc-spi/src/main/java/io/r2dbc/spi/UserPasswordCredentialImpl.java
@@ -0,0 +1,23 @@
+package io.r2dbc.spi;
+
+public class UserPasswordCredentialImpl implements UserPasswordCredential {
+
+    private String user;
+
+    private CharSequence password;
+
+    UserPasswordCredentialImpl(String user, CharSequence password) {
+        this.user = user;
+        this.password = password;
+    }
+
+    @Override
+    public String user() {
+        return this.user;
+    }
+
+    @Override
+    public CharSequence password() {
+        return this.password;
+    }
+}