secret token also needs to be an evn var