don't expose the secret token to the world, generate the secret_token on demand