use SECRET_KEY_BASE instead of SECRET_TOKEN