managing secret token