diff --git a/config/config.go b/config/config.go
index db7bf51..8631cb2 100644
--- a/config/config.go
+++ b/config/config.go
@@ -55,8 +55,8 @@ type Config struct {
 }
 
 func (c *Config) Validate() error {
-	if len(c.Secret.Key) == 0 || c.Secret.Host == "" {
-		return fmt.Errorf("incorrect secret %s", c.Secret.String())
+	if !c.Secret.Valid() {
+		return fmt.Errorf("invalid secret %s", c.Secret.String())
 	}
 
 	return nil
diff --git a/mtglib/secret.go b/mtglib/secret.go
index 2c60e30..a5b438f 100644
--- a/mtglib/secret.go
+++ b/mtglib/secret.go
@@ -22,11 +22,11 @@ type Secret struct {
 }
 
 func (s Secret) MarshalText() ([]byte, error) {
-	if s.Key == secretEmptyKey {
-		return nil, nil
+	if s.Valid() {
+		return []byte(s.String()), nil
 	}
 
-	return []byte(s.String()), nil
+	return nil, nil
 }
 
 func (s *Secret) UnmarshalText(data []byte) error {
@@ -72,6 +72,10 @@ func (s *Secret) UnmarshalText(data []byte) error {
 	return nil
 }
 
+func (s Secret) Valid() bool {
+	return s.Key != secretEmptyKey && s.Host != ""
+}
+
 func (s Secret) String() string {
 	return s.Base64()
 }
diff --git a/mtglib/secret_test.go b/mtglib/secret_test.go
index 1bb3f7b..49f80cd 100644
--- a/mtglib/secret_test.go
+++ b/mtglib/secret_test.go
@@ -99,6 +99,17 @@ func (suite *SecretTestSuite) TestInvariant() {
 	suite.Equal("google.com", parsed.Host)
 }
 
+func (suite *SecretTestSuite) TestValid() {
+	s := mtglib.Secret{}
+	suite.False(s.Valid())
+
+	s.Key[0] = 1
+	suite.False(s.Valid())
+
+	s.Host = "11"
+	suite.True(s.Valid())
+}
+
 func TestSecret(t *testing.T) {
 	t.Parallel()
 	suite.Run(t, &SecretTestSuite{})