Secret token should be set from env var