now we have a secret and access limitation on pay