add support for secret, server-side only config