secret settings for token, duh