secret token moved to env