We do need secret for app token