secret token goes to settings.yml