secret_token is allowed to be uploaded