APP_KEY and APP_SECRET in config.json