move secret token into the config.yaml