ALways use env var for secret key