moved secret token to .env file