fixed secret token extraction