move secret token to a environment var