The secret callback does not support asynchronous functions. Often times the secret has to be retrieved from a database.