secret token is now generated dynamically