it might be nice to do this without the secret key to demonstrate that this can happen client side