use SECRET_TOKEN from env