mixed up digest secret token and public key