Hiding an API Token in a theme component

Rather than creating a new controller to do it (which isn’t clearly what Richard recommended) you can fairly easily add it to an existing serializer, something like

  add_to_serializer(:current_user, :my_stuff) do
    stuff = get_my_stuff_somehow
    stuff
  end

FIguring out what serializers are available and which one you want is hopefully simple enough (most are pretty easy to guess, but you can find them in app/serializers); searching GitHub - discourse/all-the-plugins · GitHub for add_to_serializer should provide plenty of examples. And start with GitHub - discourse/discourse-plugin-skeleton: Template for Discourse plugins · GitHub.

Even if you don’t know Ruby or Rails, the above should give you a pretty good idea what you need to do. If not, you can ask in Marketplace with a budget.