accept secret key from env
ignore .env