moved secret key to an export var