it is 'secret' not 'password'