Use an env var for the secret token