hide secret token; thus need to add it in deploy