moved secret token to env var