moved secret key to env