dynamically generate secret token