move secret token to environment