Having "tokens and secrets" at all is a lack of security hygiene.