moved secret token to an environment variable for security