expose token,secret on client instance