secret token is local