change secret_token to env variable