need start on server to hold secret key