hide app secret token