secret token and db password feature