get secret token from environment