be more clear for both use cases for generating a new secret (initial configuration / forgot secret)