secret_token workaround