put secret token in env var