Which API token are you talking about? Also might be easier to come chat about this in IRC/Slack: indieweb.org/discuss

ah, if you don't mind everyone having access to query your webmentions on webmention.io then it's fine to make that public, either in github or in Javascript on your site.

I would recommend adding it as an env var in the Netlify UI - there it will only be exposed to your build environment and any Lambda functions you run.