add secret for API calls