set up secret token