diff --git a/app/app/components/section/papertrail/type-editor.js b/app/app/components/section/papertrail/type-editor.js
index c3245eb7..127ced77 100644
--- a/app/app/components/section/papertrail/type-editor.js
+++ b/app/app/components/section/papertrail/type-editor.js
@@ -42,9 +42,7 @@ export default Ember.Component.extend(SectionMixin, NotifierMixin, TooltipMixin,
 
 		this.set('config', config);
 
-		if (this.get('config.APIToken').length > 0) {
-			this.send('auth');
-		}
+		this.send('auth');
 	},
 
 	willDestroyElement() {
@@ -65,15 +63,6 @@ export default Ember.Component.extend(SectionMixin, NotifierMixin, TooltipMixin,
 		},
 
 		auth() {
-			// missing data?
-			this.set('config.APIToken', this.get('config.APIToken').trim());
-
-			if (is.empty(this.get('config.APIToken'))) {
-				$("#papertrail-apitoken").addClass("error").focus();
-				console.log("auth token empty");
-				return;
-			}
-
 			let page = this.get('page');
 			let config = this.get('config');
 			let self = this;
@@ -93,7 +82,12 @@ export default Ember.Component.extend(SectionMixin, NotifierMixin, TooltipMixin,
 							self.set('waiting', false);
 
 							let options = self.get('options');
-							let group = _.findWhere(options.groups, { id: config.group.id });
+							let group = {};
+							if (is.not.null(config.group)) {
+								group = _.findWhere(options.groups, { id: config.group.id });
+							} else {
+								group = options.groups[0];
+							}
 							if (is.not.undefined(group)) {
 								Ember.set(config, 'group', group);
 							}
diff --git a/app/app/components/section/trello/type-editor.js b/app/app/components/section/trello/type-editor.js
index e5aa6b7b..9030b958 100644
--- a/app/app/components/section/trello/type-editor.js
+++ b/app/app/components/section/trello/type-editor.js
@@ -16,50 +16,50 @@ import TooltipMixin from '../../../mixins/tooltip';
 import SectionMixin from '../../../mixins/section';
 
 export default Ember.Component.extend(SectionMixin, NotifierMixin, TooltipMixin, {
-    sectionService: Ember.inject.service('section'),
-    isDirty: false,
-    busy: false,
-    authenticated: false,
-    config: {},
-    boards: null,
-    noBoards: false,
+	sectionService: Ember.inject.service('section'),
+	isDirty: false,
+	busy: false,
+	authenticated: false,
+	config: {},
+	boards: null,
+	noBoards: false,
 	appKey: "",
 
-    boardStyle: Ember.computed('config.board', function() {
-        let board = this.get('config.board');
+	boardStyle: Ember.computed('config.board', function () {
+		let board = this.get('config.board');
 
-        if (is.null(board) || is.undefined(board)) {
-            return "#4c4c4c";
-        }
+		if (is.null(board) || is.undefined(board)) {
+			return "#4c4c4c";
+		}
 
-        let color = board.prefs.backgroundColor;
-        return Ember.String.htmlSafe("background-color: " + color);
-    }),
+		let color = board.prefs.backgroundColor;
+		return Ember.String.htmlSafe("background-color: " + color);
+	}),
 
-    didReceiveAttrs() {
-        let page = this.get('page');
+	didReceiveAttrs() {
+		let page = this.get('page');
 		let config = {};
 		let self = this;
 
 		try {
-            config = JSON.parse(this.get('meta.config'));
-        }
-        catch (e) {}
+			config = JSON.parse(this.get('meta.config'));
+		} catch (e) {}
 
-        if (is.empty(config)) {
-            config = {
-                token: "",
-                user: null,
-                board: null,
-                lists: []
-            };
-        }
+		if (is.empty(config)) {
+			config = {
+				token: "",
+				user: null,
+				board: null,
+				lists: []
+			};
+		}
 
-        this.set('config', config);
+		this.set('config', config);
 
 		this.get('sectionService').fetch(page, "config", {})
-            .then(function(s) {
+			.then(function (s) {
 				self.set('appKey', s.appKey);
+				self.set('config.token', s.token); // the user's own token, drawn from the DB
 
 				// On auth callback capture user token
 				let hashToken = window.location.hash;
@@ -70,175 +70,173 @@ export default Ember.Component.extend(SectionMixin, NotifierMixin, TooltipMixin,
 					}
 				}
 
-		        if (self.get('appKey') !== "" && self.get('config.token') !== "") {
-		            self.send('auth');
-		        }
-		        else {
-		            Ember.$.getScript("https://api.trello.com/1/client.js?key=" + self.get('appKey'), function() {
-		                Trello.deauthorize();
-		            });
-		        }
-            }, function(error) { //jshint ignore: line
-                console.log(error);
-            });
-    },
+				if (self.get('appKey') !== "" && self.get('config.token') !== "") {
+					self.send('auth');
+				} else {
+					Ember.$.getScript("https://api.trello.com/1/client.js?key=" + self.get('appKey'), function () {
+						Trello.deauthorize();
+					});
+				}
+			}, function (error) { //jshint ignore: line
+				console.log(error);
+			});
+	},
 
-    willDestroyElement() {
-        this.destroyTooltips();
-    },
+	willDestroyElement() {
+		this.destroyTooltips();
+	},
 
-    getBoardLists() {
-        this.set('busy', true);
+	getBoardLists() {
+		this.set('busy', true);
 
-        let self = this;
-        let boards = this.get('boards');
-        let board = this.get('config.board');
-        let page = this.get('page');
+		let self = this;
+		let boards = this.get('boards');
+		let board = this.get('config.board');
+		let page = this.get('page');
 
-        if (is.null(boards) || is.undefined(boards) || boards.length === 0) {
-            this.set('noBoards', true);
-            return;
-        }
+		if (is.null(boards) || is.undefined(boards) || boards.length === 0) {
+			this.set('noBoards', true);
+			return;
+		}
 
-        this.set('noBoards', false);
+		this.set('noBoards', false);
 
-        if (is.null(board) || is.undefined(board)) {
-            if (boards.length) {
-                board = boards[0];
-                this.set('config.board', board);
-            }
-        }
-        else {
-            this.set('config.board', boards.findBy('id', board.id));
-        }
+		if (is.null(board) || is.undefined(board)) {
+			if (boards.length) {
+				board = boards[0];
+				this.set('config.board', board);
+			}
+		} else {
+			this.set('config.board', boards.findBy('id', board.id));
+		}
 
-        this.get('sectionService').fetch(page, "lists", self.get('config'))
-            .then(function(lists) {
-                let savedLists = self.get('config.lists');
-                if (savedLists === null) {
-                    savedLists = [];
-                }
+		this.get('sectionService').fetch(page, "lists", self.get('config'))
+			.then(function (lists) {
+				let savedLists = self.get('config.lists');
+				if (savedLists === null) {
+					savedLists = [];
+				}
 
-                lists.forEach(function(list) {
-                    let saved = savedLists.findBy("id", list.id);
-                    let included = true;
-                    if (is.not.undefined(saved)) {
-                        included = saved.included;
-                    }
-                    list.included = included;
-                });
+				lists.forEach(function (list) {
+					let saved = savedLists.findBy("id", list.id);
+					let included = true;
+					if (is.not.undefined(saved)) {
+						included = saved.included;
+					}
+					list.included = included;
+				});
 
-                self.set('config.lists', lists);
-                self.set('busy', false);
-            }, function(error) { //jshint ignore: line
-                self.set('busy', false);
-                self.set('authenticated', false);
-                self.showNotification("Unable to fetch board lists");
-                console.log(error);
-            });
-    },
+				self.set('config.lists', lists);
+				self.set('busy', false);
+			}, function (error) { //jshint ignore: line
+				self.set('busy', false);
+				self.set('authenticated', false);
+				self.showNotification("Unable to fetch board lists");
+				console.log(error);
+			});
+	},
 
-    actions: {
-        isDirty() {
-            return this.get('isDirty');
-        },
+	actions: {
+		isDirty() {
+			return this.get('isDirty');
+		},
 
-        onListCheckbox(id) {
-            let lists = this.get('config.lists');
-            let list = lists.findBy('id', id);
+		onListCheckbox(id) {
+			let lists = this.get('config.lists');
+			let list = lists.findBy('id', id);
 
-            if (list !== null) {
-                Ember.set(list, 'included', !list.included);
-            }
-        },
+			if (list !== null) {
+				Ember.set(list, 'included', !list.included);
+			}
+		},
 
-        auth() {
-            if (this.get('appKey') === "") {
-                $("#trello-appkey").addClass('error').focus();
-                this.set('authenticated', false);
-                return;
-            }
+		auth() {
+			if (this.get('appKey') === "") {
+				$("#trello-appkey").addClass('error').focus();
+				this.set('authenticated', false);
+				return;
+			}
 
-            let self = this;
-            let page = this.get('page');
+			let self = this;
+			let page = this.get('page');
 
-            self.set('busy', true);
+			self.set('busy', true);
 
-            Ember.$.getScript("https://api.trello.com/1/client.js?key=" + this.get('appKey'), function() {
-                Trello.authorize({
-                    type: "redirect",
-                    interactive: true,
-                    name: "Documize",
-                    scope: {
-                        read: true,
-                        write: false
-                    },
-                    expiration: "never",
-                    persist: true,
-                    success: function() {
-                        self.set('authenticated', true);
-                        self.set('config.token', Trello.token());
-                        self.set('busy', true);
+			Ember.$.getScript("https://api.trello.com/1/client.js?key=" + this.get('appKey'), function () {
+				Trello.authorize({
+					type: "redirect",
+					interactive: true,
+					name: "Documize",
+					scope: {
+						read: true,
+						write: false
+					},
+					expiration: "never",
+					persist: true,
+					success: function () {
+						self.set('authenticated', true);
+						self.set('config.token', Trello.token());
+						self.set('busy', true);
 
-                        Trello.members.get("me", function(user) {
-                            self.set('config.user', user);
-                        }, function(error) {
-                            console.log(error);
-                        });
+						Trello.members.get("me", function (user) {
+							self.set('config.user', user);
+						}, function (error) {
+							console.log(error);
+						});
 
-                        self.get('sectionService').fetch(page, "boards", self.get('config'))
-                            .then(function(boards) {
-                                self.set('busy', false);
-                                self.set('boards', boards);
-                                self.getBoardLists();
-                            }, function(error) { //jshint ignore: line
-                                self.set('busy', false);
-                                self.set('authenticated', false);
-                                self.showNotification("Unable to fetch boards");
-                                console.log(error);
-                            });
-                    },
-                    error: function(error) {
-                        self.set('busy', false);
-                        self.set('authenticated', false);
-                        self.showNotification("Unable to authenticate");
-                        console.log(error);
-                    }
-                });
-            });
-        },
+						self.get('sectionService').fetch(page, "boards", self.get('config'))
+							.then(function (boards) {
+								self.set('busy', false);
+								self.set('boards', boards);
+								self.getBoardLists();
+							}, function (error) { //jshint ignore: line
+								self.set('busy', false);
+								self.set('authenticated', false);
+								self.showNotification("Unable to fetch boards");
+								console.log(error);
+							});
+					},
+					error: function (error) {
+						self.set('busy', false);
+						self.set('authenticated', false);
+						self.showNotification("Unable to authenticate");
+						console.log(error);
+					}
+				});
+			});
+		},
 
-        onBoardChange(board) {
-            this.set('isDirty', true);
-            this.set('config.board', board);
-            this.set('config.lists', []);
-            this.getBoardLists();
-        },
+		onBoardChange(board) {
+			this.set('isDirty', true);
+			this.set('config.board', board);
+			this.set('config.lists', []);
+			this.getBoardLists();
+		},
 
-        onCancel() {
-            this.attrs.onCancel();
-        },
+		onCancel() {
+			this.attrs.onCancel();
+		},
 
-        onAction(title) {
-            this.set('busy', true);
+		onAction(title) {
+			this.set('busy', true);
 
-            let self = this;
-            let page = this.get('page');
-            let meta = this.get('meta');
-            page.set('title', title);
-            meta.set('rawBody', '');
-            meta.set('config', JSON.stringify(this.get('config')));
-            meta.set('externalSource', true);
+			let self = this;
+			let page = this.get('page');
+			let meta = this.get('meta');
+			page.set('title', title);
+			meta.set('rawBody', '');
+			meta.set('config', JSON.stringify(this.get('config')));
+			meta.set('externalSource', true);
 
-            this.get('sectionService').fetch(page, "cards", this.get('config'))
-                .then(function(response) {
-                    meta.set('rawBody', JSON.stringify(response));
-                    self.set('busy', false);
-                    self.attrs.onAction(page, meta);
-                }, function(reason) { //jshint ignore: line
-                    self.set('busy', false);
-                    self.attrs.onAction(page, meta);
-                });
-        }
-    }
-});
+			this.get('sectionService').fetch(page, "cards", this.get('config'))
+				.then(function (response) {
+					meta.set('rawBody', JSON.stringify(response));
+					self.set('busy', false);
+					self.attrs.onAction(page, meta);
+				}, function (reason) { //jshint ignore: line
+					self.set('busy', false);
+					self.attrs.onAction(page, meta);
+				});
+		}
+	}
+});
\ No newline at end of file
diff --git a/documize/section/papertrail/papertrail.go b/documize/section/papertrail/papertrail.go
index 28e9ab80..a76a3195 100644
--- a/documize/section/papertrail/papertrail.go
+++ b/documize/section/papertrail/papertrail.go
@@ -104,7 +104,7 @@ func (p *Provider) Command(ctx *provider.Context, w http.ResponseWriter, r *http
 
 	config.Clean()
 
-	if config.APIToken == provider.SecretReplacement {
+	if config.APIToken == provider.SecretReplacement || config.APIToken == "" {
 		config.APIToken = ctx.GetSecrets("APIToken")
 	}
 
diff --git a/documize/section/trello/model.go b/documize/section/trello/model.go
index d5f58b23..34f70236 100644
--- a/documize/section/trello/model.go
+++ b/documize/section/trello/model.go
@@ -35,6 +35,10 @@ const renderTemplate = `
 </div>
 `
 
+type secrets struct {
+	Token  string `json:"token"`
+}
+
 type trelloConfig struct {
 	AppKey string       `json:"appKey"`
 	Token  string       `json:"token"`
diff --git a/documize/section/trello/trello.go b/documize/section/trello/trello.go
index 32fcb6ad..59327705 100644
--- a/documize/section/trello/trello.go
+++ b/documize/section/trello/trello.go
@@ -25,7 +25,6 @@ import (
 )
 
 var meta provider.TypeMeta
-var appKey string
 
 func init() {
 	meta = provider.TypeMeta{}
@@ -49,11 +48,6 @@ func (*Provider) Command(ctx *provider.Context, w http.ResponseWriter, r *http.R
 	query := r.URL.Query()
 	method := query.Get("method")
 
-	if len(method) == 0 {
-		provider.WriteMessage(w, "trello", "missing method name")
-		return
-	}
-
 	defer r.Body.Close()
 	body, err := ioutil.ReadAll(r.Body)
 
@@ -70,19 +64,20 @@ func (*Provider) Command(ctx *provider.Context, w http.ResponseWriter, r *http.R
 		return
 	}
 
-	if appKey == "" {
-		appKey = request.ConfigString(meta.ConfigHandle(), "appKey")
+	config.Clean()
+	config.AppKey = request.ConfigString(meta.ConfigHandle(), "appKey")
+
+	if len(config.AppKey) == 0 {
+		log.ErrorString("missing trello App Key")
+		provider.WriteMessage(w, "trello", "Missing appKey")
+		return
 	}
 
-	config.Clean()
-	config.AppKey = appKey
+	if len(config.Token) == 0 {
+		config.Token = ctx.GetSecrets("token") // get a token, if we have one
+	}
 
 	if method != "config" {
-		if len(config.AppKey) == 0 {
-			provider.WriteMessage(w, "trello", "Missing appKey")
-			return
-		}
-
 		if len(config.Token) == 0 {
 			provider.WriteMessage(w, "trello", "Missing token")
 			return
@@ -94,8 +89,9 @@ func (*Provider) Command(ctx *provider.Context, w http.ResponseWriter, r *http.R
 		render, err := getCards(config)
 
 		if err != nil {
-			fmt.Println(err)
+			log.IfErr(err)
 			provider.WriteError(w, "trello", err)
+			log.IfErr(ctx.SaveSecrets("")) // failure means our secrets are invalid
 			return
 		}
 
@@ -105,8 +101,9 @@ func (*Provider) Command(ctx *provider.Context, w http.ResponseWriter, r *http.R
 		render, err := getBoards(config)
 
 		if err != nil {
-			fmt.Println(err)
+			log.IfErr(err)
 			provider.WriteError(w, "trello", err)
+			log.IfErr(ctx.SaveSecrets("")) // failure means our secrets are invalid
 			return
 		}
 
@@ -116,24 +113,36 @@ func (*Provider) Command(ctx *provider.Context, w http.ResponseWriter, r *http.R
 		render, err := getLists(config)
 
 		if err != nil {
-			fmt.Println(err)
+			log.IfErr(err)
 			provider.WriteError(w, "trello", err)
+			log.IfErr(ctx.SaveSecrets("")) // failure means our secrets are invalid
 			return
 		}
 
 		provider.WriteJSON(w, render)
 
 	case "config":
-		if method == "config" {
-			var config struct {
-				AppKey string `json:"appKey"`
-			}
-
-			config.AppKey = appKey
-			provider.WriteJSON(w, config)
-			return
+		var ret struct {
+			AppKey string `json:"appKey"`
+			Token  string `json:"token"`
 		}
+		ret.AppKey = config.AppKey
+		ret.Token = config.Token
+		provider.WriteJSON(w, ret)
+		return
+
+	default:
+		log.ErrorString("trello unknown method name: " + method)
+		provider.WriteMessage(w, "trello", "missing method name")
+		return
 	}
+
+	// the token has just worked, so save it as our secret
+	var s secrets
+	s.Token = config.Token
+	b, e := json.Marshal(s)
+	log.IfErr(e)
+	log.IfErr(ctx.SaveSecrets(string(b)))
 }
 
 // Render just sends back HMTL as-is.