Do not hardcode secret_token