use environment variable for secret token in production