add secret_token otherwise the spec can not pass