move secret token to environment var