hide secret_token