The web service consumer has no control over the credentials required by the web service provider. You have to pass what the provider requires in each environment.
That said, a best practice is to never hardcode environment-specific attributes such as endpoint URLs, ports, or credentials. Store those in a property file and retrieve them when your package starts. There are many posts here on wMUsers related to use of properties files.
Mark
#webMethods#soa#API-Management