secret token config, doesnt check for staging