move secret token into config file