accept token and secret as params