move secret token to environment variable out of hardcoded file