[build] get token outside secure scope