better app secret handling