Better way to do secret token