restrict by secret