added secret handling to web service