use secret on client and server