Which API token are you talking about? Also might be easier to come chat about this in IRC/Slack: indieweb.org/discuss
ah, if you don't mind everyone having access to query your webmentions on webmention.io then it's fine to make that public, either in github or in Javascript on your site.

Apr 8, 2018 · 6:18 PM UTC

1
Replying to @aaronpk @Netlify
I would recommend adding it as an env var in the Netlify UI - there it will only be exposed to your build environment and any Lambda functions you run.
1
That's probably a better idea :-) In any case the token only provides read access so it's not a huge deal.
1