actually use the a secret token