now using a shared secret to prevent usage by unauthed users
added env file
added env file