The secretKey should only be used within a server side and never exposed to client devices.
The secret key from the admin panel (only required for modifying/revealing access permissions).
Keep away from Android.