backing
secret token
initializer on server