Use env var secret token in production