pull secret_token from hidden file & config vars