move secret token to environemntal variable for security