move secret to config