use dynamic secret_token, ref:Listing 3.2