Use a separate secret token instead of the UID
Rename "to" into "peer"