move secret token to env var