move token to env var