Generally this ought to be kept as an environment variable. Keeping the secret token public means that it's possible for others to impersonate your users.

Here's the docs on using configuration variables with heroku: https://devcenter.heroku.com/articles/config-vars