working with secret token