secret token validatable as per environment