moved xxxId & secrets out of js files