note that secret_key is required