move secret_token to yml