default to using the app secret