diff --git a/setup.py b/setup.py
index d7ce4c9c..12a180a2 100644
--- a/setup.py
+++ b/setup.py
@@ -76,7 +76,7 @@
     python_requires='>=3.10.4',
     install_requires=[
         'hio>=0.6.10',
-        'keri @ git+https://git@github.com/provenant-dev/keripy.git@v1.1.6-pr9',
+        'keri @ git+https://git@github.com/provenant-dev/keripy.git@VC-390',
         'mnemonic>=0.21',
         'multicommand>=1.0.0',
         'falcon>=3.1.3',
diff --git a/src/keria/__main__.py b/src/keria/__main__.py
index eb5e76ea..690692be 100644
--- a/src/keria/__main__.py
+++ b/src/keria/__main__.py
@@ -12,6 +12,6 @@
 
 from keria.app.cli.keria import main
 
-if __name__ == "__main__":
-    main()
 
+if __name__ == "__main__":
+    main.run()
diff --git a/src/keria/app/agenting.py b/src/keria/app/agenting.py
index 1c00a36a..d629731e 100644
--- a/src/keria/app/agenting.py
+++ b/src/keria/app/agenting.py
@@ -46,11 +46,36 @@
 from ..core.keeping import RemoteManager
 from ..db import basing
 
+import cProfile
+import pstats
+import threading
+import time
+
 logger = ogler.getLogger()
 
 
-def setup(name, bran, adminPort, bootPort, base='', httpPort=None, configFile=None, configDir=None,
+def profile_app(interval=10, output_file=os.getenv("PROFILER_REPORT_FILE", "/home/origin/data/reports/profile.prof")):
+    profiler = cProfile.Profile()
+    profiler.enable()
+
+    def save_report():
+        while True:
+            print(f"Profiling report saved to {output_file}")
+            time.sleep(interval)
+            profiler.dump_stats(output_file)
+
+    # Start background thread to save profile periodically
+    threading.Thread(target=save_report, daemon=True).start()
+    return profiler
+
+def setup(name, bran, adminPort, bootPort, credentialsPort, base='', httpPort=None, configFile=None, configDir=None,
           keypath=None, certpath=None, cafilepath=None):
+
+    if os.getenv("PROFILING_ENABLED", "false").lower() in ("true", "1"):
+        print("Start profiling")
+        profiler = profile_app()
+    else:
+        print("Profiling disabled")
     """ Set up an ahab in Signify mode """
 
     agency = Agency(name=name, base=base, bran=bran, configFile=configFile, configDir=configDir)
@@ -118,6 +143,22 @@ def setup(name, bran, adminPort, bootPort, base='', httpPort=None, configFile=No
         specEnd.addRoutes(happ)
         happ.add_route("/spec.yaml", specEnd)
 
+    if os.getenv("SEPARATE_CREDENTIAL_CONTROLLER", "false").lower() in ("true", "1"):
+        print(f"Separate credential controller enabled on port {credentialsPort}")
+        # credentials
+        capp = falcon.App(middleware=falcon.CORSMiddleware(
+            allow_origins='*', allow_credentials='*',
+            expose_headers=['cesr-attachment', 'cesr-date', 'content-type', 'signature', 'signature-input',
+                            'signify-resource', 'signify-timestamp']))
+        credentialing.loadCredentialsQuery(capp)
+        credentialsServer = createHttpServer(credentialsPort, capp, keypath, certpath, cafilepath)
+        credentialsDoer = http.ServerDoer(server=credentialsServer)
+        doers.append(credentialsDoer)
+    else:
+        print("Separate credential controller disabled")
+        credentialing.loadCredentialsQuery(app)
+
+
     print("The Agency is loaded and waiting for requests...")
     return doers
 
diff --git a/src/keria/app/cli/commands/start.py b/src/keria/app/cli/commands/start.py
index 9a9dc2dd..c44d9034 100644
--- a/src/keria/app/cli/commands/start.py
+++ b/src/keria/app/cli/commands/start.py
@@ -36,6 +36,10 @@
                     default=3903,
                     help="Boot port number the Boot HTTP server listens on.  This port needs to be secured."
                          " Default is 3903.")
+parser.add_argument('-C', '--credentials',
+                    action='store',
+                    default=3904,
+                    help="Port for credentials operations. Default is 3904.")
 parser.add_argument('-n', '--name',
                     action='store',
                     default="keria",
@@ -83,6 +87,7 @@ def launch(args):
              admin=int(args.admin),
              http=int(args.http),
              boot=int(args.boot),
+             credentials=int(args.credentials),
              configFile=args.configFile,
              configDir=args.configDir,
              keypath=args.keypath,
@@ -93,7 +98,7 @@ def launch(args):
                 ".******", args.name, args.admin, args.http)
 
 
-def runAgent(name="ahab", base="", bran="", admin=3901, http=3902, boot=3903, configFile=None,
+def runAgent(name="ahab", base="", bran="", admin=3901, http=3902, boot=3903, credentials=3904, configFile=None,
              configDir=None, keypath=None, certpath=None, cafilepath=None, expire=0.0):
     """
     Setup and run a KERIA Agency
@@ -104,6 +109,7 @@ def runAgent(name="ahab", base="", bran="", admin=3901, http=3902, boot=3903, co
                                 adminPort=admin,
                                 httpPort=http,
                                 bootPort=boot,
+                                credentialsPort=credentials,
                                 configFile=configFile,
                                 configDir=configDir,
                                 keypath=keypath,
diff --git a/src/keria/app/credentialing.py b/src/keria/app/credentialing.py
index 70185c9a..02b83ec9 100644
--- a/src/keria/app/credentialing.py
+++ b/src/keria/app/credentialing.py
@@ -40,10 +40,10 @@ def loadEnds(app, identifierResource):
     credentialResourceDelEnd = CredentialResourceDeleteEnd(identifierResource)
     app.add_route("/identifiers/{name}/credentials/{said}", credentialResourceDelEnd)
 
+def loadCredentialsQuery(app):
     queryCollectionEnd = CredentialQueryCollectionEnd()
     app.add_route("/credentials/query", queryCollectionEnd)
 
-
 class RegistryCollectionEnd:
     """
     ReST API for admin of credential issuance and revocation registries