use secret token in folder for production env