use environment variable for the secret token