public function parse($query, $secret = null)
    {
        $secret = $secret ? Secret::create($secret) : $this->secret;
        if (null === $secret) {
            throw new \RuntimeException('Secret not set on instance, be sure to pass it on parse.');
        }

        $query = is_array($query) ? new QueryString($query) : QueryString::fromString($query);

        if (! $query->isValid($secret)) {
            throw new \RuntimeException('Bad signature for payload.');
        }

        $data = QueryString::fromString(base64_decode($query['sso']));

        return new Payload($data->all() + [ 'sso_secret' => $secret ]);
    }