Use a private secret_token in production