get secret token from env