using secret to get auth to ban