err, make that secret token